feat: Complete public package publishing and pnpm installation flow

[Fuyeors]

Summary

This PR completes the first public FPM package publishing and pnpm installation path.

The registry now accepts the existing fpm_... personal access tokens as Bearer credentials while retaining browser JWT/cookie authentication. Publishing remains restricted to organization members, package versions are immutable, and commit verifies the upload session owner, manifest identity, SemVer, SHA-256 format, and object-storage presence.

A new independent @fuyeor/fpm-cli package under packages/cli/ publishes source packages through acquire -> presigned PUT -> commit. It uses Node.js 24.19.0+, TypeScript/ESM, native fetch, a small tar-stream/zlib packer, .gitignore, manifest files, and workspace dependency normalization. It does not use npm legacy PUT /package or execute unknown lifecycle scripts.

The registry exposes npm-compatible Minimal Abbreviated Metadata and a liveness endpoint. Metadata derives latest from the highest valid SemVer and points pnpm to public R2 tarballs at packages/@scope/name/version.tgz. The staging Dockerfile, Compose file, environment template, README, and STAGING.md document deployment through nginx /v1.

Verification

• Node.js 24.19.0 + pnpm 11.22.0: CLI build passed.
• CLI unit tests: 3 passed.
• CLI publish e2e: passed, including Bearer token, request order, manifest, and uploaded SHA-256 validation.
• Local npm-compatible registry e2e: pnpm add @demo/install-fixture, exact-version install, and repeated pnpm install passed.
• fpm frontend production build: passed after replacing three stale imports from monorepo components that are not currently exported.
• Rust cargo fmt --check, cargo check --workspace, and cargo test --workspace: passed; 3 backend unit tests passed.
• cargo build --release --workspace: passed.
• pnpm install --frozen-lockfile with pnpm 11.22.0: passed.

Staging follow-up

The sandbox does not provide a Docker daemon or the staging PostgreSQL/R2 credentials, so the real Docker image build and real object-storage publish must be executed on the Docker host. Follow STAGING.md to apply migrations, start the service, check /v1/health, publish a real package, and validate the three required pnpm commands.

Scope notes

This PR supports public downloads and existing organization-member publish permissions. Package-level access-control settings, unpublish/deprecation, dist-tags beyond latest, binary artifacts, and the full install/consumer protocol remain follow-up work.