The npm registry is a seat gitea holds, and gitea holds the git seat a build's source can live on

Implements novox/hq ADR 0109, 0110 and 0111 in the catalogue.

package-registry becomes npm-package-registry throughout (ADR 0109): gitea provides and serves it,
verdaccio provides it, the builder requires, binds and receives its secret under it. gitea's
contributions file is grants/npm.json, so a second ecosystem's file has an obvious name beside it.

gitea claims two mesh seats (ADR 0110): npm-package-registry, which it delivers, and git, which it
now provides with what a clone URL is composed from — http on the forge's web port (ADR 0111).
verdaccio provides npm-package-registry and claims nothing: it is the second provider the seat
exists to make harmless, since a consumer now resolves to the seat's holder without a pin.

No cargo or PyPI provision is added; ADR 0109 defers that. git mints no credential, so gitea's
provisioner registers nothing for it — the mesh's own repositories are public, and a clone
credential is undecided (ADR 0111).

The provisioner still reads where its contributions land from $MESH_RECEIVES, and names no path
itself. One variable carries one path, so a second registration in this module would need the mesh
to say where each provision's file is; that is not possible yet and is not faked here.

Verified: the controller's tests read this catalogue — every claim is a seat in the set, the forge
holds both seats and serves what a clone URL needs, the builder requires what the npm seat delivers
— and pass. Not verified here: a TypeScript build of gitea, whose dependencies resolve from the
private registry.

modules/gitea/module.json

@@ -49,18 +49,32 @@
     }
   ],
   "serves": {
-    "package-registry": {
+    "npm-package-registry": {
       "scheme": "http",
       "port": 3000,
       "npm-path": "/api/packages/novox/npm/"
+    },
+    "git": {
+      "scheme": "http",
+      "port": 3000
     }
   },
   "receives": {
-    "package-registry": "/var/lib/gitea/grants/mesh.json"
+    "npm-package-registry": "/var/lib/gitea/grants/npm.json"
   },
   "grants": {
-    "package-registry": "/var/lib/gitea/grants"
+    "npm-package-registry": "/var/lib/gitea/grants"
   },
+  "claims": [
+    {
+      "name": "npm-package-registry",
+      "scope": "mesh"
+    },
+    {
+      "name": "git",
+      "scope": "mesh"
+    }
+  ],
   "own-secrets": {
     "broker": "/var/lib/mesh/gitea/broker"
   },
@@ -177,7 +191,7 @@
         "MESH_GITEA_ADMIN_USER": "mesh-admin",
         "MESH_GITEA_ADMIN_PASSWORD_FILE": "/run/secrets/admin",
         "MESH_GITEA_STATE_DIR": "/run/state",
-        "MESH_RECEIVES": "/var/lib/gitea/grants/mesh.json"
+        "MESH_RECEIVES": "/var/lib/gitea/grants/npm.json"
       },
       "artifact": "runtime",
       "restart-on": [
@@ -187,7 +201,11 @@
   ],
   "provides": [
     {
-      "name": "package-registry",
+      "name": "npm-package-registry",
+      "scope": "mesh"
+    },
+    {
+      "name": "git",
       "scope": "mesh"
     }
   ],