test(npm): boot the npm virtual wiring against a database, part 3/3 (S31 plan: 14/19)

📦 Stacked MRs

This is part 3 of 3 of Step 14 of the S31 (npm-virtual) plan, the composition root. It targets main. Review and merge bottom-up.

🎯 What this part does

Adds a database-backed boot test for the npm virtual composition (integration build tag):

• A seeded virtual repository (its parent row, its npm binding and its npm_virtual_repositories row) boots through the real dispatcher, so the real finder walks the row to the virtual arm. The packument, dist-tags and tarball routes answer 501 without calling an upstream, and a boot with no public registry URL still succeeds.
• The resolver records an upstream exclusion through the root's audit sink, so a denial leaves an audit line. This test adds a hosted upstream, its association and a deny rule to the seed.

Lint: golangci-lint run --build-tags=integration is clean on the new file.

docs/testing/ and docs/user/ are unchanged: every npm virtual route still answers 501.

Stacked MRs (review/merge bottom-up)

• feat(npm): share the remote tier and drop the U... (!3074 - merged) • David Fernandez • 19.5
• feat(npm): compose the npm virtual read path at... (!3075 - merged) • David Fernandez • 19.5
• test(npm): boot the npm virtual wiring against ... (!3076 - merged) • David Fernandez • 19.5 👈

Related to #895 (closed)