gitea: say what keeps each npm version and delete only what nothing names (hq ADR 0251)

Every publish added a version and nothing removed one. A Go bundle beside the
TypeScript one keeps what a lockfile or a range on the forge names, what a
dist-tag names and the newest five; a dry run unless asked with a why, and
nothing deleted while any repository is unread.

modules/gitea/module.json

@@ -239,6 +239,23 @@
           "MESH_GITEA_STATE_DIR": "${dir:runtime-state}",
           "MESH_RECEIVES": "${dir:grants}/npm.json"
         }
+      },
+      {
+        "name": "npm-registry",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/npm-registry",
+        "binary": "npm-registry",
+        "loads": [
+          "npm-registry"
+        ],
+        "env": {
+          "MESH_GITEA_URL": "http://127.0.0.1:${port:3000}",
+          "MESH_GITEA_ADMIN_USER": "mesh-admin",
+          "MESH_GITEA_ADMIN_PASSWORD_FILE": "${dir:state}/admin.secret",
+          "MESH_NPM_OWNER": "novox"
+        }
       }
     ]
   },