proxy mirror lists versions from the public registry instead of the configured upstream #524

proxy mirror without a version enumerates versions through registries.New(ecosystem, "", client) in internal/mirror/source.go, so the listing always comes from the public registry and ignores upstream.*. With PROXY_UPSTREAM_NPM=http://127.0.0.1:1, proxy mirror -dry-run pkg:npm/left-pad still lists 15 versions. Ecosystems with no default registry URL (Helm, Swift, Alpine) can't be enumerated at all, since registries.New refuses an empty URL for them.

The listing should use the same configured upstream the proxy serves from, as #414 does for artifact resolution.

Separately, proxy mirror -dry-run pkg:npm/typescript fails with unexpected end of JSON input, because the registries client truncated any body over 10 MiB. git-pkgs/registries#109 streams npm packuments; picking that up needs a registries release and a dependency bump here.