fix(upstream): honor npm and Cargo overrides

[andrew]

Summary

• pass upstream.npm into the npm handler for metadata and tarball requests
• pass upstream.cargo and upstream.cargo_download into the Cargo handler
• construct artifact download URLs from the configured origins instead of the resolver public defaults
• preserve public defaults for empty settings and normalize trailing slashes
• cover custom origins with path prefixes for npm metadata/downloads and Cargo index/downloads

Why

The configuration exposed npm and Cargo upstream overrides, but the server did not pass them into either handler. Even when handler metadata origins were changed manually, artifact downloads still used the resolver hard-coded public registries.

Validation

• go test -race ./... -count=1
• go tool golangci-lint run ./...

[Copilot]

Pull request overview

This PR wires the configured upstream overrides for npm and Cargo into their respective protocol handlers so metadata and artifact downloads are fetched from the configured origins (with sane defaults and trailing-slash normalization).

Changes:

• Pass cfg.Upstream.NPM into NewNPMHandler, and cfg.Upstream.Cargo / cfg.Upstream.CargoDownload into NewCargoHandler.
• Build npm and Cargo artifact download URLs from the handler-configured upstream origins via GetOrFetchArtifactFromURL.
• Add tests to validate that configured upstreams are honored for metadata and downloads.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
internal/server/server.go	Plumbs upstream override config into npm and Cargo handlers at server startup.
internal/server/server_test.go	Updates test server setup to match new handler constructor signatures.
internal/handler/npm.go	Adds configurable upstream origin and uses it when constructing npm tarball download URLs.
internal/handler/npm_test.go	Adds coverage ensuring configured npm upstream is used for metadata and downloads.
internal/handler/cargo.go	Adds configurable index/download origins and uses configured download origin for crate downloads.
internal/handler/cargo_test.go	Adds coverage ensuring configured Cargo index and download upstreams are used.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.