docs(npm): add npm-hosted plan Step 26 (wire route table to real handlers)

Amends the S11 npm-hosted plan to add the route-table wiring step that was never assigned after Step 8.

• internal/format/npm/handler.go still dispatches every format route to the notImplemented 501 placeholder, including the already-merged read handlers (tarball download, packument GET, dist-tags GET). No step was ever assigned handler.go as (Modify).
• New Step 26: refactor NewHandler into an OCI-style NewDispatchHandlerWith* constructor chain (an unwired route falls back to the interim 501), inject the real handlers in wire_npm.go (threading the shared BlobStore and cfg.Npm), and add per-action wiring tests plus a composition-root boot test. Mirrors OCI (S12) and Maven (S10), which inject handlers at the composition root; the seam follows OCI's chain per review.
• Cross-format datastore alignment (converging the merged npm/Maven stores onto OCI's explicit qrm.DB provider-closure per ADR-023) is out of scope here and tracked in #256.
• Step 23 (conformance) re-pointed at Step 26; the DAG, Status table, and Testing Strategy are updated to match.
• Both #238 (closed) ride-alongs resolve out: the repositories.soft_deleted_at gate on the async rebuild path already landed in NpmPackageByID, and the pool-relative rebuildMaxInFlight change stays deferred to S27 per the existing TODO(s27-cache-rebuild).

Related to #238 (closed)