Allow regular user JWTs on registry endpoints

[rgarcia]

Summary

• allow /v2/* registry routes to fall back from builder-scoped registry token validation to regular user JWT validation
• keep builder token validation, repo scoping, and mirror fallback behavior unchanged for registry-scoped tokens
• add middleware tests covering regular user JWT access on registry read and write paths

Test plan

• go test ./lib/middleware
• Exercise hypeman push end-to-end against a dev hypeman server

Made with Cursor

---

Note

Medium Risk
Changes authentication behavior for /v2/* registry routes and refactors JWT validation, which is security-sensitive and could affect access control if misconfigured.

Overview
Allows /v2/* registry requests to fall back to regular user JWT validation when builder/registry-scoped token validation fails, enabling direct registry access with user tokens while keeping existing mirror fallback behavior for errRepoNotAllowed.

Refactors user JWT handling by centralizing parsing/type-rejection in validateUserToken and context population in contextWithUserClaims, and adds middleware tests to cover registry read/write access using both full-access and scoped user tokens.

^{Written by Cursor Bugbot for commit 2cce73f. This will update automatically on new commits. Configure here.}