GeezerVison

PR #241 sends a combined Accept header so upstreams that reject the abbreviated
packument type fall back to full metadata, but the combined header still
prefers the abbreviated format — so registry.npmjs.org keeps returning
packuments with no time map, and with cache_metadata on, that timeless body
is served to every client regardless of the client's own Accept header. The
only way to get full packuments today is to enable cooldown, which ties a
metadata-format choice to a filtering feature.

Timeless packuments break clients that gate on publish age. Yarn 4's
npmMinimalAgeGate (on by default in recent Yarn) fails closed when
timestamps are missing, so every resolution through the proxy is refused, old
versions included:

yarn add [email protected]
➤ YN0016: │ lodash@npm:4.17.21: All versions satisfying "4.17.21" are quarantined

Changes:

• Add upstream.npm_full_metadata (env PROXY_UPSTREAM_NPM_FULL_METADATA,
  default false); when set, the npm metadata fetch uses application/json
  exclusively, independent of cooldown
• Wire it through the shared Proxy struct the way GradleReadOnly and
  DirectServe are
• Document it in config.example.yaml and docs/configuration.md
• Test beside the existing Accept-header cases: the option forces full
  metadata with cooldown disabled

Placed under upstream beside the npm URL it modifies, since that section
already carries fetch behavior (allow_private_hosts, allow_loopback,
auth) — happy to move it top-level next to cache_metadata/metadata_ttl
if you prefer that grouping, or to a different shape entirely (for example
honoring the client's Accept header with per-format caching, which would also
work but costs a second cached copy per package).

go test ./..., go fmt, go vet clean.

Companion PR: #296 (making the cooldown download check read stored publish
times instead of re-parsing packuments).