0.0.9

• features:
• support semver range version ( ~x.y.z / ^x.y.z, ^ comes url-encoded as %5E ):
  range urls are resolved to the latest satisfying version and 302-redirected to the
  specific version url, so content urls stay immutable and range dirs never land on disk.
• provider.resolve resolves a range against the provider chain; version lists are
  cached per provider in <pkg>/.reg.versions.<provider> with cachetime-based expiry.
• providers implement fetch-version-list: github via releases?per_page=100
  ( most recent 100 only ), npm via registry metadata versions.
• ngx config: proxy_cache_valid now covers 302 ( ttl of range resolving ) and 400.
• ngx config: ignore / hide Set-Cookie in registry backend proxy -- session middleware
  sets cookie on every response, which silently disabled proxy cache altogether.
• bug fix:
• fix npm provider name ( was github )
• route now responds 400 ( instead of 404 ) for invalid version / range syntax,
  and no longer double-sends response on 500.
• tweaks:
• move @plotdb/semver to dependencies ( requires v0.0.4+, for max-satisfying etc. )
  and drop the duplicate devDependencies entry
• add build / test npm scripts; add stub-based tests covering range resolving,
  redirect routing, cache reuse and error codes ( test/index.ls, no network needed )
• upgrade tar 6 -> 7.5.21 for critical path-traversal / symlink-poisoning advisories
  ( registry extracts remote tarballs into an nginx-served dir, so these matter here );
  api usage ( tar.x {strip, cwd} ) is unchanged, but node >= 18 is now required
  ( engines updated; was >= 10 )