CrowdSec hub pull has no per-item mirror fallback when only the item download fails #1806

What: After #1798 the index walk and cscli paths fall back to the GitHub raw mirror, but Pull in backend/internal/crowdsec/hub_sync.go does not try the mirror for a single item download when the index came from the CDN and the item fetch then fails at transport level.

Where: backend/internal/crowdsec/hub_sync.go (Pull), hub_mirror.go.

Evidence: Found in the #1798 plan review (Q-B). The Go walk ignores MirrorMemory by design, so a CDN that answers the index but drops item downloads still fails the install.

Severity: low

Suggestion: On a transport-level item failure, retry once against the mirror URL for the same item and verify the digest as usual.

Found in #1798.