feat(npm): request middleware and context plumbing (S11 Step 6, 3/4)

What

Part 3 of 4 splitting !425 (closed) (S11 Step 6). The request middleware and context plumbing.

• Middleware resolves the {slug}/{repo} URL prefix, stores the (namespace_id, slug, repository_id) triple in the request context for downstream handlers, and on a miss writes the tier-accurate 404 envelope (namespace_not_found / repository_not_found) without calling next.
• A non-sentinel resolver error becomes a 500 whose body carries no internal detail, per S11 Security Considerations.
• No auth concern: S08's central auth middleware runs before npm code.

Stack

Targets dm/npm-step6-resolver (part 2). Merge order: transport → resolver → middleware → integration.

Tests

middleware_test.go (unit): context round-trip, nil-dependency panics, middleware HTTP behavior (success + both 404s + no-leak 500). Integration coverage lands in part 4.

Spec / plan

• Spec: S11 npm-local — API Contracts, Error Cases (AC 32 / AC 33), Security Considerations
• Plan: 2026-05-11 npm-local, Step 6