fix(pm): support authenticated private registries

[RSS1102]

Problem

Vite+ respects NPM_CONFIG_REGISTRY when downloading a pinned package manager, but previously ignored registry credentials from .npmrc. Authenticated corporate registries therefore returned 401 before the requested package manager could run.

Behavior

Registry configuration is merged in this order:

explicit globalconfig < user .npmrc < workspace .npmrc < NPM_CONFIG_*

Package routing then uses @scope:registry, followed by registry, and finally the public npm registry.

Authentication uses the same configuration-source order. Credentials are matched to the final request URL by host, port, and longest path, with _authToken, _auth, and username/_password support. Matching credentials are sent on the first metadata and tarball requests.

NPM_TOKEN remains an environment-variable value referenced by a registry-scoped .npmrc entry:

registry=https://npm.corp.example/repository/npm/
//npm.corp.example/repository/npm/:_authToken=${NPM_TOKEN}

This keeps credentials bound to their intended registry instead of treating one token as valid for every configured endpoint.

Validation

• cargo test -p vp_pm_cli --lib (759 passed, 2 ignored)
• cargo clippy -p vp_pm_cli --lib --tests -- -D warnings
• git diff --check

Closes #2603

[netlify]

✅ Deploy Preview for viteplus-preview canceled.

Name	Link
🔨 Latest commit	27d5247
🔍 Latest deploy log	https://app.netlify.com/projects/viteplus-preview/deploys/6a9ed926dea5f40008bc7b67