…ay statuses

Replaces the bespoke `reqwest::Client` builder in `Upstream` with
`pacquet_network::ThrottledClient::new_for_installs()`, so the
registry inherits pnpm's tuned defaults — `User-Agent: pnpm`,
HTTP/1.1, hickory DNS, pool and timeout settings, the concurrency
semaphore, and (later) per-registry TLS routing — instead of
rolling its own and missing every one of them.

Also splits the gateway error response by failure mode rather than
falling back to a blanket `502` on every upstream failure:

* `is_timeout()` → `504 Gateway Timeout`
* `is_connect()` → `503 Service Unavailable`
* anything else / upstream 5xx → `502 Bad Gateway`

Mirrors verdaccio's role in the proxy: the npm client already has
the configured `fetch-retries` policy, so the registry's job is to
surface accurate gateway status so the client's retry loop fires
on truly transient failures and gives up on permanent ones. No
proxy-side retry — see verdaccio v4.0.3 / #1331 for the same
reasoning.