…pm#502)

Closes pnpm#497.

## Summary

Adds per-registry TLS overrides keyed by nerf-darted `.npmrc` URI, the natural follow-up to pnpm#490's top-level TLS keys. Corporate environments running a private Verdaccio (or any registry with its own self-signed cert) can now pin scoped `:cafile=…` / `:cert=…` / `:key=…` per host without disabling strict-ssl globally.

Three commits, layered:

- **`feat(network)`** (eff1248e): adds `RegistryTls` + `PerRegistryTls` types in `pacquet-network` plus the lookup machinery — `pick_for_url` ports pnpm's [5-step `pickSettingByUrl`](https://github.com/pnpm/pnpm/blob/94240bc046/network/fetch/src/dispatcher.ts#L338-L375) exactly (exact > nerf-dart > no-port > shorter prefix > recursive no-port retry). `ThrottledClient::for_installs` gains a third `&PerRegistryTls` parameter and pre-builds one reqwest `Client` per non-empty override. New `acquire_for_url(url: &str)` routes per-request; `acquire()` keeps the default-client behavior for callers without a URL.

- **`feat(config)`** (4e69868a): `NpmrcAuth` parses the six per-registry TLS suffixes (`:ca`, `:cafile`, `:cert`, `:certfile`, `:key`, `:keyfile`) matching pnpm's `SSL_SUFFIX_RE` and applies onto `Config.tls_by_uri`. `*file` variants read from disk at parse time (silent on error); inline values get `\\n` → `\n` expansion. `:cert` and `:certfile` share the same `tls.cert` slot — last-write-wins inside one `.npmrc`.

- **`refactor(tarball,registry)`** (5f9cae93): three production call sites (registry metadata + version-tag fetches, plus two tarball download paths) move from `acquire()` to `acquire_for_url(url)` so the per-registry routing actually fires.

## Parity policy

Bug-for-bug with pnpm v11 ([SHA 94240bc](https://github.com/pnpm/pnpm/blob/94240bc046/config/reader/src/getNetworkConfigs.ts)):

- **Field-by-field override**, not replace-all. Each scoped `ca` / `cert` / `key` overrides its top-level counterpart independently (mirroring upstream's `{ ...opts, ...sslConfig }` spread at `dispatcher.ts:143,264`). `strict_ssl` and `local_address` stay top-level-only — pnpm's regex doesn't recognize scoped versions.
- **`ca` as `Option<String>`, not `Vec<String>`**: per-registry `ca` is a single string (possibly with concatenated `-----END CERTIFICATE-----` delimiters) — `reqwest::Certificate::from_pem` accepts both shapes.
- **Inline `\\n` expansion only on per-registry**: pnpm applies `value.replace(/\\n/g, '\n')` to scoped values but not to top-level `ca=`. The divergence is intentional and matches upstream.
- **Lax URI prefix check**: `foo:cert=…` (no `//` prefix) is accepted into the map with `uri_prefix = "foo"`. It never matches a real nerf-darted URL so the entry is dropped at lookup time, but storing it keeps byte-for-byte parsing parity with `tryParseSslKey`.

## Reviewer flags

- **Per-registry clients duplicate connection pools.** Each unique override gets its own `reqwest::Client` and therefore its own connection pool. With N per-registry overrides the worker holds N+1 pools instead of one. The semaphore still bounds *concurrent in-flight requests* globally, but socket churn between registries with different TLS configs is now per-client. In practice most users have ≤2 overrides; if this becomes an issue we'd need to switch to rustls + custom certificate verifier (tracked under pnpm#499).
- **`acquire_for_url` takes `&str` rather than `&Url`** so the existing `format!("{registry}{name}")` call sites don't need to round-trip through `Url::parse`. The lookup itself works on the raw string form via `nerf_dart`.

…eys (pnpm#509)

Replaces the `native-tls-vendored` reqwest feature with `rustls`,
closing the PKCS#1 parity gap flagged in pnpm#499. Native-tls's
`Identity::from_pkcs8_pem` accepted only `-----BEGIN PRIVATE KEY-----`
(PKCS#8); rustls's `Identity::from_pem` accepts PKCS#1
(`-----BEGIN RSA PRIVATE KEY-----`), PKCS#8, and EC keys — the same
surface Node's `tls.createSecureContext` exposes to pnpm via undici.

Pacquet now matches pnpm bug-for-bug on the set of client-cert key
formats accepted from `.npmrc`'s `key=` / `:key=` / `:keyfile=`
entries. PKCS#12 (`.pfx`) stays out of scope — pnpm's `.npmrc`
allow-list doesn't expose a `pfx=` option so pacquet doesn't either.

## What changed

- `Cargo.toml`: drop `native-tls-vendored`, add `rustls`. Reqwest's
  `rustls` feature uses `aws-lc-rs` for crypto and
  `rustls-platform-verifier` for OS trust roots — closest behavioral
  match to native-tls's "consult the platform trust store" default.
- `crates/network/src/lib.rs`: `apply_tls` swaps
  `Identity::from_pkcs8_pem(cert, key)` for `Identity::from_pem`
  applied to the concatenated `cert\nkey` PEM buffer. Adds a new
  `looks_like_pem_cert` syntactic check before
  `Certificate::from_pem` because rustls's `from_pem` stores the
  bytes verbatim and validates lazily at `Client::build()` time —
  a garbage CA entry would otherwise slip through silently and the
  install would proceed against an unknown trust root.
- Updated doc comments on `apply_tls`, `TlsConfig::key`,
  `RegistryTls::key`, and `TlsError::InvalidClientIdentity` to
  describe the new surface and drop the PKCS#8-only caveat.
- `deny.toml`: allow `CDLA-Permissive-2.0` for `webpki-root-certs`
  (pulled in by reqwest's `rustls` feature through
  `rustls-platform-verifier`'s fallback chain).
- New fixtures at `crates/network/tests/fixtures/test-client-pkcs1.{crt,key}`
  loaded via `include_str!`. Regenerable with `openssl genrsa
  -traditional` + `openssl req -new -x509`.

## Tests

`for_installs_with_pkcs1_client_key_builds` pins the contract — if
a future change reverts the backend or otherwise narrows the
accepted key formats, this build will fail with a clear
`InvalidClientIdentity`. All 1175 workspace tests pass.

## Notes for review

- **Cert store change.** `rustls-platform-verifier` reads the OS
  trust store on macOS / Windows / Linux. The lookup is a different
  syscall path from native-tls's; behavioral parity for "trust roots
  in the OS store" should hold, but corporate CAs that worked under
  native-tls and *don't* show up in `rustls-platform-verifier`'s
  enumeration would now silently fail. Users hitting that should
  add the CA explicitly via `cafile=` in `.npmrc`.
- **Performance.** CI's integrated-benchmark will run on this PR; if
  it regresses materially on the warm-install path we'd consider
  falling back to the preprocessing approach (option 2 in pnpm#499).
- **`hickory-dns` compatibility.** Verified by running the workspace
  test suite — DNS resolution is independent of the TLS backend.
- **`cargo deny` posture.** One new license allowance
  (`CDLA-Permissive-2.0`) for `webpki-root-certs`. No new advisory
  surface area beyond what reqwest's `rustls` feature already pulls
  through `aws-lc-rs` / `rustls` / `rustls-platform-verifier`.

…pm#502)

Closes pnpm#497.

## Summary

Adds per-registry TLS overrides keyed by nerf-darted `.npmrc` URI, the natural follow-up to pnpm#490's top-level TLS keys. Corporate environments running a private Verdaccio (or any registry with its own self-signed cert) can now pin scoped `:cafile=…` / `:cert=…` / `:key=…` per host without disabling strict-ssl globally.

Three commits, layered:

- **`feat(network)`** (eff1248e): adds `RegistryTls` + `PerRegistryTls` types in `pacquet-network` plus the lookup machinery — `pick_for_url` ports pnpm's [5-step `pickSettingByUrl`](https://github.com/pnpm/pnpm/blob/94240bc046/network/fetch/src/dispatcher.ts#L338-L375) exactly (exact > nerf-dart > no-port > shorter prefix > recursive no-port retry). `ThrottledClient::for_installs` gains a third `&PerRegistryTls` parameter and pre-builds one reqwest `Client` per non-empty override. New `acquire_for_url(url: &str)` routes per-request; `acquire()` keeps the default-client behavior for callers without a URL.

- **`feat(config)`** (4e69868a): `NpmrcAuth` parses the six per-registry TLS suffixes (`:ca`, `:cafile`, `:cert`, `:certfile`, `:key`, `:keyfile`) matching pnpm's `SSL_SUFFIX_RE` and applies onto `Config.tls_by_uri`. `*file` variants read from disk at parse time (silent on error); inline values get `\\n` → `\n` expansion. `:cert` and `:certfile` share the same `tls.cert` slot — last-write-wins inside one `.npmrc`.

- **`refactor(tarball,registry)`** (5f9cae93): three production call sites (registry metadata + version-tag fetches, plus two tarball download paths) move from `acquire()` to `acquire_for_url(url)` so the per-registry routing actually fires.

## Parity policy

Bug-for-bug with pnpm v11 ([SHA 94240bc](https://github.com/pnpm/pnpm/blob/94240bc046/config/reader/src/getNetworkConfigs.ts)):

- **Field-by-field override**, not replace-all. Each scoped `ca` / `cert` / `key` overrides its top-level counterpart independently (mirroring upstream's `{ ...opts, ...sslConfig }` spread at `dispatcher.ts:143,264`). `strict_ssl` and `local_address` stay top-level-only — pnpm's regex doesn't recognize scoped versions.
- **`ca` as `Option<String>`, not `Vec<String>`**: per-registry `ca` is a single string (possibly with concatenated `-----END CERTIFICATE-----` delimiters) — `reqwest::Certificate::from_pem` accepts both shapes.
- **Inline `\\n` expansion only on per-registry**: pnpm applies `value.replace(/\\n/g, '\n')` to scoped values but not to top-level `ca=`. The divergence is intentional and matches upstream.
- **Lax URI prefix check**: `foo:cert=…` (no `//` prefix) is accepted into the map with `uri_prefix = "foo"`. It never matches a real nerf-darted URL so the entry is dropped at lookup time, but storing it keeps byte-for-byte parsing parity with `tryParseSslKey`.

## Reviewer flags

- **Per-registry clients duplicate connection pools.** Each unique override gets its own `reqwest::Client` and therefore its own connection pool. With N per-registry overrides the worker holds N+1 pools instead of one. The semaphore still bounds *concurrent in-flight requests* globally, but socket churn between registries with different TLS configs is now per-client. In practice most users have ≤2 overrides; if this becomes an issue we'd need to switch to rustls + custom certificate verifier (tracked under pnpm#499).
- **`acquire_for_url` takes `&str` rather than `&Url`** so the existing `format!("{registry}{name}")` call sites don't need to round-trip through `Url::parse`. The lookup itself works on the raw string form via `nerf_dart`.

…eys (pnpm#509)

Replaces the `native-tls-vendored` reqwest feature with `rustls`,
closing the PKCS#1 parity gap flagged in pnpm#499. Native-tls's
`Identity::from_pkcs8_pem` accepted only `-----BEGIN PRIVATE KEY-----`
(PKCS#8); rustls's `Identity::from_pem` accepts PKCS#1
(`-----BEGIN RSA PRIVATE KEY-----`), PKCS#8, and EC keys — the same
surface Node's `tls.createSecureContext` exposes to pnpm via undici.

Pacquet now matches pnpm bug-for-bug on the set of client-cert key
formats accepted from `.npmrc`'s `key=` / `:key=` / `:keyfile=`
entries. PKCS#12 (`.pfx`) stays out of scope — pnpm's `.npmrc`
allow-list doesn't expose a `pfx=` option so pacquet doesn't either.

## What changed

- `Cargo.toml`: drop `native-tls-vendored`, add `rustls`. Reqwest's
  `rustls` feature uses `aws-lc-rs` for crypto and
  `rustls-platform-verifier` for OS trust roots — closest behavioral
  match to native-tls's "consult the platform trust store" default.
- `crates/network/src/lib.rs`: `apply_tls` swaps
  `Identity::from_pkcs8_pem(cert, key)` for `Identity::from_pem`
  applied to the concatenated `cert\nkey` PEM buffer. Adds a new
  `looks_like_pem_cert` syntactic check before
  `Certificate::from_pem` because rustls's `from_pem` stores the
  bytes verbatim and validates lazily at `Client::build()` time —
  a garbage CA entry would otherwise slip through silently and the
  install would proceed against an unknown trust root.
- Updated doc comments on `apply_tls`, `TlsConfig::key`,
  `RegistryTls::key`, and `TlsError::InvalidClientIdentity` to
  describe the new surface and drop the PKCS#8-only caveat.
- `deny.toml`: allow `CDLA-Permissive-2.0` for `webpki-root-certs`
  (pulled in by reqwest's `rustls` feature through
  `rustls-platform-verifier`'s fallback chain).
- New fixtures at `crates/network/tests/fixtures/test-client-pkcs1.{crt,key}`
  loaded via `include_str!`. Regenerable with `openssl genrsa
  -traditional` + `openssl req -new -x509`.

## Tests

`for_installs_with_pkcs1_client_key_builds` pins the contract — if
a future change reverts the backend or otherwise narrows the
accepted key formats, this build will fail with a clear
`InvalidClientIdentity`. All 1175 workspace tests pass.

## Notes for review

- **Cert store change.** `rustls-platform-verifier` reads the OS
  trust store on macOS / Windows / Linux. The lookup is a different
  syscall path from native-tls's; behavioral parity for "trust roots
  in the OS store" should hold, but corporate CAs that worked under
  native-tls and *don't* show up in `rustls-platform-verifier`'s
  enumeration would now silently fail. Users hitting that should
  add the CA explicitly via `cafile=` in `.npmrc`.
- **Performance.** CI's integrated-benchmark will run on this PR; if
  it regresses materially on the warm-install path we'd consider
  falling back to the preprocessing approach (option 2 in pnpm#499).
- **`hickory-dns` compatibility.** Verified by running the workspace
  test suite — DNS resolution is independent of the TLS backend.
- **`cargo deny` posture.** One new license allowance
  (`CDLA-Permissive-2.0`) for `webpki-root-certs`. No new advisory
  surface area beyond what reqwest's `rustls` feature already pulls
  through `aws-lc-rs` / `rustls` / `rustls-platform-verifier`.