[zeroshade]

Stacked on #549.

Brings the language bindings up to the CLI's registry and auth handling. Goes through internal/api → C ABI → Rust → npm-wasm.

Registries

• Explicit registry list: registries: [{url, name}] (C: registry.<n>.url / registry.<n>.name) → dbc.WithRegistries. It is used as given, with no merging.
• Behaviour change: bindings now honor the user's global config.toml by default, like the CLI. registryConfig: "none" (C: registry_config=none) opts out. In the browser it is always none.
• Project registries: projectFile (C: project_file) → the registries / replace_defaults keys from a dbc.toml.
• baseURL or an explicit list overrides all configuration files, as DBC_BASE_URL does for the CLI.

Credentials

• login(credential) / logout(registryURL) (C: dbc_login, dbc_logout) store or remove token credentials in dbc's credential store.
• An injected credential now applies only to its own host; other hosts fall back to stored credentials, matching what the header already documented. credentialStore: "none" (C: credential_store=none) disables stored-credential lookup.
• auth.AddCredential/RemoveCredential re-read the credentials file before writing. Without this, a stale snapshot held by another worker or process dropped other entries on write. Test included.

License

• licensePath() / installLicense(path, {force}) (C: dbc_license_path, dbc_install_license + DBC_LICENSE_FORCE).

The C ABI goes from 13 to 17 exports; Rust bindings are regenerated. Node/Rust docs note that credential lookups in an already-running runtime don't see changes another runtime makes.

Testing

Go (including -race ./auth), npm-wasm smoke and worker tests, Rust tests and clippy, bindgen drift check, and a throwaway C ABI smoke run against a local registry with an isolated credential store.