Greptile Summary

This PR adds OTP (one-time password) challenge handling to aube publish. When a PUT to the registry responds with a 401/403 that looks like an OTP requirement and --otp was not supplied, the CLI prompts for the code interactively (masked input via demand) and retries once; in non-interactive environments it returns a clear --otp <CODE> hint instead.

• Publish PUT is extracted into send_publish_put, returning miette::Result<Result<(), PublishHttpFailure>> so HTTP-level failures are structured and inspectable before deciding whether to retry.
• publish_failure_needs_otp implements a heuristic matching common npm OTP error patterns (EOTP, npm-otp, two-factor, 2FA with "required").
• Seven unit tests cover both positive and negative detection cases.

Confidence Score: 5/5

Safe to merge; the retry is bounded to a single attempt and only fires when the registry explicitly signals an OTP requirement with no --otp already supplied.

The refactor is clean and well-tested with seven targeted unit tests covering both positive and negative OTP detection cases. The existing --otp flow is unchanged.

No files require special attention.

Important Files Changed

_{Reviews (4): Last reviewed commit: "fix(publish): prompt for OTP on registry..." | Re-trigger Greptile}