fix: pass npm auth token when fetching from the registry

[sverdlov93]

Why?

getRegistry() returns the registry URL, but every caller then uses fetch() without auth headers. This causes 401 on any npm registry that requires authentication.

How?

getRegistry() now also reads the registry's _authToken from the npm config and returns { registry, authToken? }. All three callers — SWC binary download, lockfile patching and next info — pass it as a Bearer header when present.

Same execSync-based npm config get pattern already used for the URL. No new dependencies. Adds one unit test file (test/unit/get-registry.test.ts, 5 cases: token present, undefined token, config get throwing, registries with a path, and non-URL output falling back to the default registry).

Scope: bearer-token registries (Artifactory, GitHub Packages, Verdaccio, npm). Legacy _auth / _password basic auth is not handled — that needs a different header scheme and was left out to keep the change minimal.

Related

Reference	Title
Closes #59081	next build not using npm token when downloading SWC
#68522	fix: NPM Workspace ENOWORKSPACES (merged, same getRegistry pattern)
#86841	Dev Server ENOWORKSPACES with PNPM 10
discussion #73479	Found lockfile missing swc dependencies - npm workspaces (14 👍)
discussion #78235	Failed to download SWC package (404 from a mirrored registry)
discussion #30468	Failed to load SWC feedback megathread

The last three are discussions rather than issues, so bare #-references to them don't link; using full URLs instead.

Related but deliberately not fixed here

#85071 (getVersionInfo fails behind corporate firewalls) asks for the same thing one layer over: the dev-server staleness check in hot-reloader-shared-utils.ts hardcodes https://registry.npmjs.org/-/package/next/dist-tags instead of consulting .npmrc. Routing it through getRegistry() would fix that report and pick up auth for free, but getRegistry() shells out to npm config get via execSync, and putting that on the dev-startup path would regress exactly what #67309 optimized. It needs a cached or lazy lookup, so I left it out of this PR. Happy to follow up separately if that's the direction you'd want.

[nextjs-bot]

Allow CI Workflow Run

• approve CI run for commit: 5bdc95226fc38c945f8a4e28469a592683e233fe

Note: this should only be enabled once the PR is ready to go and can only be enabled by a maintainer

[nextjs-bot]

Allow CI Workflow Run

• approve CI run for commit: b486b46

Note: this should only be enabled once the PR is ready to go and can only be enabled by a maintainer

[sverdlov93]

Rebased onto today's canary (f6d0940) — the earlier CI run was against a base from March, which is why every build job died in seconds. History is now a single commit with no merge commit.

Verified locally on that base:

• pnpm build — 16/16 turbo tasks
• tsc --noEmit — clean
• jest test/unit/get-registry.test.ts — 5/5 passing
• prettier --check and eslint on the five changed files — clean

One scoping note on the implementation: it reads _authToken from the npm config, which covers bearer-token registries (Artifactory, GitHub Packages, Verdaccio, npm itself). Legacy _auth/_password basic auth isn't handled — that would need a different header scheme, and I left it out to keep the change minimal. Happy to add it if you'd prefer full coverage.

@bgw — the workflow run needs a maintainer to approve it; would you mind kicking it off now that it's on a current base?

@eps1lon — you touched get-registry.ts / download-swc.ts most recently, so tagging you in case you have opinions on the shape of the return value or on whether basic auth should be covered here too.