feat(pm): add private npm registry auth

[elrrrrrrr]

Summary

• Support Bearer token authentication for private npm registries
• Token resolved from NPM_TOKEN / NODE_AUTH_TOKEN env vars or ~/.utoo/config.toml (utoo login)
• ruborist HTTP client made injectable (set_http_client) — stays auth-unaware
• Tarball downloads use hostname guard to prevent token leakage to third-party CDNs

Design

Layer	Responsibility
ruborist	Zero auth awareness. HTTP client settable from outside via set_http_client, otherwise auto-built
pm/user_config	Resolves token, builds client with Authorization: Bearer default header, injects into ruborist
pm/downloader	Holds token locally, attaches Bearer only when tarball URL host matches registry host

Test plan

• NPM_TOKEN=<token> ut install with a private scoped package
• utoo login + ut install reads token from ~/.utoo/config.toml
• Public registry install still works without token
• Tarball from a CDN URL does not receive the auth header

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request refactors the auto-update mechanism to include a 24-hour retry cooldown and introduces private registry authentication support by injecting Bearer tokens into HTTP clients. Key changes include moving the update check to a non-blocking background task and adding a global authentication token resolver. Feedback focuses on improving the robustness of host extraction for token attachment, handling potential token parsing failures, and addressing thread-safety issues in tests that modify environment variables.

[gemini-code-assist]

Using std::env::set_var in tests is unsafe and can cause race conditions when tests are run in parallel, as the environment is shared across the process. Additionally, this test no longer calls init_auto_update(), so it doesn't verify the CI-skipping logic it intends to test.

[gemini-code-assist]

The manual string parsing for host extraction is fragile and doesn't handle authentication info in the URL (e.g., https://user:pass@host). Since the url crate is already a dependency, it's recommended to use it for robust host extraction, or at least improve the string manipulation to handle the auth part.

Suggested change

	fn extract_host(url: &str) -> &str {
	let without_scheme = url
	.strip_prefix("https://")
	.or_else(|| url.strip_prefix("http://"))
	.unwrap_or(url);
	without_scheme.split('/').next().unwrap_or(without_scheme)
	}
	fn extract_host(url: &str) -> &str {
	let without_scheme = url
	.strip_prefix("https://")
	.or_else(|| url.strip_prefix("http://"))
	.unwrap_or(url);
	let host_part = without_scheme.split('/').next().unwrap_or(without_scheme);
	host_part.rsplit('@').next().unwrap_or(host_part)
	}

[gemini-code-assist]

If the token contains characters that are invalid for an HTTP header value (like newlines), parse() will fail silently, and the client will be configured without authentication. This can lead to confusing 401 errors later. Consider logging a warning or returning early if the token is invalid.

        let Ok(val) = format!("Bearer {token}").parse() else {
            tracing::warn!("Failed to parse auth token for registry {}", registry);
            return;
        };
        headers.insert(AUTHORIZATION, val);