npm: wire publish QuotaChecker once the quota subsystem is available (nil admits all, from S11 Step 26)

Summary

The npm publish handler is mounted in production (S11 Step 26, !836 (merged)) with its QuotaChecker seam left nil. publish.go's QuotaChecker is the per-request namespace storage-quota / per-organization upload-session-count check; a nil checker is treated as "always within quota", so every authenticated publish is admitted with no per-request quota enforcement.

Before Step 26 the publish route returned 501, so the gap had no runtime effect. After Step 26 it is live in production routing.

This is a known, deliberate gap for the milestone — the per-request npm quota subsystem is not yet built — surfaced by the automated AppSec review on !836 (merged). Filing it so the gap is tracked and not silently forgotten, per the reviewer's remediation.

Scope

  • Wire npm.WithQuotaChecker(...) in cmd/artifact-registry/wire_npm.go (buildNpmDispatcher) to the real quota subsystem once it exists.
  • Related: session-start storage-quota enforcement is defined in ADR 004 Storage Quota and enforced by S06; this issue covers the npm publish handler's per-request QuotaChecker seam specifically.
  • Note: the OCI wiring (wire_oci.go) has no analogous per-request quota seam today, so this is npm-specific.

Acceptance

  • buildNpmDispatcher supplies a non-nil QuotaChecker backed by the quota subsystem.
  • Publish returns 429 quota_exceeded when a namespace is over quota.
  • Test coverage for the over-quota rejection path.