fix(registry): restore protocol routing and test coverage for npm, oci, and api flows

test/e2e/npm.e2e.test.ts

@@ -15,9 +15,12 @@ import {
   createTestApiToken,
   createTestRepository,
   createTestUser,
+  getTestRegistry,
   runCommand,
   setupTestDb,
   skipIfMissing,
+  startTestServer,
+  stopTestServer,
   teardownTestDb,
   testConfig,
 } from '../helpers/index.ts';
@@ -27,7 +30,7 @@ const FIXTURE_DIR = path.join(
   '../fixtures/npm/@stack-test/demo-package',
 );
 
-describe('NPM E2E: Full lifecycle', () => {
+describe('NPM E2E: Full lifecycle', { sanitizeResources: false, sanitizeOps: false }, () => {
   let testUserId: string;
   let testOrgName: string;
   let apiToken: string;
@@ -41,11 +44,13 @@ describe('NPM E2E: Full lifecycle', () => {
 
     await setupTestDb();
     registryUrl = testConfig.registry.url;
+    await startTestServer();
   });
 
   afterAll(async () => {
     if (!shouldSkip) {
       await teardownTestDb();
+      await stopTestServer();
     }
   });
 
@@ -54,6 +59,24 @@ describe('NPM E2E: Full lifecycle', () => {
 
     await cleanupTestDb();
 
+    // Clean up S3 test packages from previous runs
+    try {
+      const bucket = getTestRegistry()?.getSmartBucket();
+      if (bucket) {
+        const b = await bucket.getBucketByName(testConfig.s3.bucket);
+        if (b) {
+          for (const key of [
+            'npm/packages/@stack-test/demo-package/index.json',
+            'npm/packages/@stack-test/demo-package/stack-test-demo-package-1.0.0.tgz',
+          ]) {
+            await b.fastRemove({ path: key }).catch(() => {});
+          }
+        }
+      }
+    } catch {
+      // Ignore S3 cleanup errors
+    }
+
     // Create test user and org
     const { user } = await createTestUser({ status: 'active' });
     testUserId = user.id;
@@ -237,11 +260,17 @@ describe('NPM E2E: Full lifecycle', () => {
         apiToken,
       );
 
-      // Unpublish
-      const unpublishResult = await clients.npm.unpublish(
-        '@stack-test/demo-package@1.0.0',
-        `${registryUrl}/-/npm/${testOrgName}/`,
-        apiToken,
+      // Unpublish (run from FIXTURE_DIR so .npmrc auth is picked up)
+      const unpublishResult = await runCommand(
+        [
+          'npm',
+          'unpublish',
+          '@stack-test/demo-package@1.0.0',
+          '--registry',
+          `${registryUrl}/-/npm/${testOrgName}/`,
+          '--force',
+        ],
+        { cwd: FIXTURE_DIR },
       );
 
       assertEquals(