perf(npm): resolve tarball version by indexed point lookup (S11 Step 9, 5/6)

📦 What

S11 Step 9 (tarball download) is a six-MR stack, in dependency order (each targets the one above; GitLab auto-retargets to main as they merge):

• !535 (merged) - two-id Resolution for npm read handlers.
• !543 (merged) - NpmVersionByPackageAndVersion datastore finder (read-side prerequisite).
• !536 (merged) - tarball download handler: serve + Cache-Control.
• !562 (merged) - last_downloaded_at bump on a served download.
• !563 (merged) - perf: resolve the version by an indexed point lookup. <- this MR
• !537 (merged) - conditional GET + strong validators.

This MR now targets main: the four parent MRs (!535 (merged), !543 (merged), !536 (merged), !562 (merged)) have merged, so it was rebased onto main.

Resolve the tarball's version with a single indexed point lookup instead of scanning the package's version history.

The file name is {plain_name}-{version}.tgz, so the exact version is parsed from it and resolved via NpmVersionByPackageAndVersion (the finder from !543 (merged)) - one index seek on the partial unique index - rather than keyset-scanning every version of the package (O(versions) on the hot path). Only the file scan within the resolved version stays paginated.

NpmVersionByPackageAndVersion is added to the shared NpmVersionFinder; the packument handler keeps using NpmVersionsByPackage for its version scan, so the download path moves to the point lookup without disturbing packument (hence the one-line stub in packument_get_test.go; the dist-tags handler shares the finder and scans too, so its test fakes get the same stub).

✅ Testing

Updates the download unit and white-box tests to the point-lookup finder fake, and adds an integration test (TestDownloadHandlerIntegration_GET_ResolvesByParsedVersion) that publishes two versions with distinct tarballs and asserts each file name resolves to its own bytes end-to-end - the parsed-version seam the unit fakes cannot cover. Behavior (200 / 404 / redirect / bump) is unchanged; this is a resolution-path optimization.

Related to #127 (closed)