First step of aligning the resolver with the auth-aware resolution cache RFC
(pnpm/rfcs#11): an uplink can now carry an `access:`
policy and a `generation`, folding the separate `upstreamAliases` concept into
the existing `uplinks` config. An uplink that declares `access:` is eligible to
back a proxied private route and be exposed at its `/~<name>/` registry
endpoint; an uplink without `access:` stays registry-proxy only.

No consumer reads the new fields yet; route classification and endpoint serving
are wired up in follow-up commits.

Route classification now sources proxied-route credentials from `uplinks:`
entries that declare an `access:` policy, in addition to the legacy
`upstreamAliases` block. Uplink-sourced credentials are matched by registry
origin (no package glob) and carry the uplink's generation; a plain proxy
uplink without `access:` is never offered as a private-route credential.

Part of aligning the resolver with the auth-aware resolution cache RFC
(pnpm/rfcs#11).

A fetch to pnpr's own `/~<uplink>/` registry endpoint is now classified as a
proxied route through that uplink, using the uplink's current generation (the
URL carries none). Since a package name can never begin with `~`, such a URL is
unambiguously an uplink endpoint, not a hosted package: an unauthorized caller
or an unknown uplink fails closed rather than falling through to the
hosted-package policy.

This is what lets a `/resolve` request whose scope is configured at a
`/~<uplink>/` endpoint classify and credential the route through the backing
uplink instead of treating its own endpoint as a third-party upstream.

Part of aligning the resolver with the auth-aware resolution cache RFC
(pnpm/rfcs#11).

Expose each access-bearing uplink as a read-only registry endpoint at
`/~<uplink>/`: packument (scoped and unscoped) and tarball reads route through
the named uplink instead of the `packages.proxy` chain, gated by the uplink's
own `access:` policy. Served packuments have their `dist.tarball` rewritten
back onto the same endpoint, so a client that points a scope at
`https://<pnpr>/~<uplink>/` gets canonical (integrity-only) lockfile entries.

The endpoint is fetch-through: it reads the uplink's packument fresh for the
version integrity and streams the tarball through a temp file verified against
it, writing nothing to the shared proxy mirror. A private uplink's packuments
and tarballs therefore never persist where the public path or another uplink
could read them — closing the metadata/tarball leak that a shared,
package-keyed mirror would open. Integration tests cover the endpoint rewrite,
fail-closed access gating, and the no-persistence property.

Part of aligning the resolver with the auth-aware resolution cache RFC
(pnpm/rfcs#11).

Replace the opaque per-tarball gateway scheme with the uplink registry
endpoints. The resolver now rewrites a proxied route's tarball to its
`/~<uplink>/<package>/-/<file>` endpoint URL (canonical for a client whose
scope is configured there, so the lockfile entry collapses to integrity-only),
keeps a public/unknown route's upstream URL untouched, and reverses endpoint
URLs back to upstream when verifying an input lockfile.

Deleted:
- the `/-/pnpr/v0/tarballs/alias|unknown/...` routes and their handlers;
- `TarballGatewayRoutes` (the in-memory HMAC key -> URL map) and the
  unknown-route gateway machinery;
- `GatewayAlias`/`gateway_alias` (replaced by `RouteContext::uplink_registry`);
- the `upstreamAliases` config block and `UpstreamAlias` type — proxied-route
  credentials now come solely from access-bearing `uplinks:` entries, matched
  by registry origin.

Tests across the route, resolver, config, and server suites are migrated from
`upstreamAliases` to access-bearing uplinks and from gateway URLs to endpoint
URLs; 518 pnpr tests pass.

Part of aligning the resolver with the auth-aware resolution cache RFC
(pnpm/rfcs#11).

Make the pnpr resolver cache authorization-aware and route private
dependencies through per-uplink registry endpoints.

Add route classification at the single fetch/auth-selection point: pnpr
selects its own server-owned upstream credentials instead of forwarding
client upstream auth, records a per-resolve footprint, and rejects inline
URL credentials. A uplinks: entry that declares an access: policy becomes
the private-route credential (folding in the former upstreamAliases block),
matched by registry origin and exposed as a read-only registry endpoint at
/~<uplink>/. access reuses bearer-token-backed pnpr identities, package
access policy, and static groups; a SHA-256 digest of the uplink's credential
participates in the footprint, so rotating the upstream credential
automatically moves new resolves to a fresh namespace. The credential is
attached only over a matching scheme (no token over plain http).

Gate every server-side fetch behind a default-deny allowlist (built-in npm
host, public routes, configured uplinks and their /~<uplink>/ endpoints, and
pnpr itself). A registry/namedRegistries matching none is rejected at the
request boundary, closing the resolver's SSRF surface at the source and
superseding the link-local denylist. The boundary also covers direct-URL
(http(s)/git, incl. scp-style) dependency specs, overrides, and lockfile
tarballs; a `..` path segment is rejected; and the same allowlist re-validates
every redirect hop. The official npm registry is a built-in host-level public
route (scoped names included), so the npmjsPublic toggle is gone. With no
off-allowlist route to resolve, every route is public or carries a private
descriptor: RouteClass::Unknown, the non-shareable footprint tier, and the
MetadataCacheScope::Bypass tier are removed. Transitive deps fetched during the
tree walk are a connect-time-guard follow-up (#12705).

Route resolver tarball URLs through those endpoints. A proxied route emits
its /~<uplink>/ endpoint URL; public routes keep their upstream URL (fetched
directly from the registry/CDN); pnpr-hosted packages use pnpr-hosted URLs.
An endpoint URL is canonical for a client whose scope
points there, so the lockfile entry stays integrity-only and the host comes
from the client's registry config rather than the lockfile — a project
resolves to the same lockfile through /resolve or a direct/proxied install.
verification_lockfile reverses endpoint URLs to upstream for input-lockfile
verification, and classification recognizes pnpr's own /~<uplink>/ URLs.
The opaque per-tarball gateway scheme and its in-memory key->URL map are
removed.

Serve each access-bearing uplink as a /~<uplink>/ registry endpoint
(packument + tarball, gated by the uplink access policy) with a private
cache namespaced by an HMAC of (uplink, credential), so a private install
caches like a public one, a rotation re-keys automatically, and a private
uplink's content never lands in the shared mirror.

Store bounded candidate lists under an auth-excluded base key instead of a
single lockfile. Public candidates match every caller; private candidates
carry the footprint and descriptor HMAC and are reused only when the caller
still satisfies the stored uplink-or-hosted gates. Compute the base key for
both no-lockfile and lockfile-seeded requests, using hash_lockfile() for
input lockfiles, and evict expired/LRU private candidates before public
ones.

Record metadata fast-path routes into the footprint. The hook only fires at
the auth-selection point, which the npm resolver's metadata fast paths
(in-memory hit, offline disk read, version-spec exact match, publishedBy
mtime shortcut) bypass. AuthHeaders::record_route drives the hook without a
request, called up front in pick_package so every layer contributes to the
footprint.

Scope the npm metadata mirror by private access descriptor. A
MetadataCacheScope (Public / Private) classified per (registry, package)
fetch threads through pick_package, fetch_full_metadata_cached, the mirror
path, in-memory/fetch-lock keys, and the verifier's local-mirror read. A
private route stores its packument under v11/metadata-private/<descriptor-id>/.
Fail closed on 401/403/private-404. The CLI installs no hook, so every fetch
stays Public and the global mirror is unchanged.

Related to #12699 and pnpm/rfcs#11.