refactor(npm): move the npm mount predicate into npmroute (part 1/4) (S09 Enforcement plan: 13/20)

Split into 4 stacked MRs to keep each part within the review size target (~800 reviewable LoC ideal). Each part targets the previous one (part 1 targets main); the stack is reviewed and merged bottom-up.

Part 1 of 4 of the S09 (authorization) enforcement plan — Step 13: npm wiring and route-table parity. Spec: S09 (authorization).

📦 What this part does

Moves the npm mount-grammar predicate out of the authz route parser into npmroute.Mounts, and rewrites npmRouteParser.Mine as a one-line delegation to it, so the mount grammar exists in exactly one package. The Segment/LiteralPos helpers become unexported (segment/literalPos) — dead exports once the delegation lands, including the compile-time literal-position guard that moves with them.

Behavior-preserving: the existing Mine tests pass with zero assertion edits, which is the acceptance the delegation was asked to meet in #855 (comment 3760941692).

📚 Stacked MRs (review/merge bottom-up)

• refactor(npm): move the npm mount predicate int... (!2131 - merged) • David Fernandez • 19.4 👈
• feat(npm): add the resolution holder and middle... (!2132 - merged) • David Fernandez • 19.4
• refactor(npm): drive the dispatcher mux from a ... (!2133 - merged) • David Fernandez • 19.4
• feat(npm): wire authz enforcement for the npm d... (!2134 - merged) • David Fernandez • 19.4

Related to #855 (closed)