refactor: simplify pypi and npm URL rewriting — single remote, no redundant config keys

- npm: remove npm_files_url/npm_files_remote; rewrite uses base_url and
  remote name directly (same approach as helm)
- npm: replace hardcoded .tgz extension check with immutable_patterns match
- pypi: collapse pypi + pypi-files into a single remote (base_url points
  to files.pythonhosted.org); simple/ requests are transparently fetched
  from pypi.org with no extra config required
- pypi: remove pypi_files_url/pypi_files_remote from pypi and pypi-gitea
- pypi: rewrite check now uses immutable_patterns (consistent with npm)
- Update README for both pypi and npm sections
- Update tests and fixtures to reflect single-remote pypi config

tests/conftest.py

@@ -73,30 +73,20 @@ TEST_REMOTES = {
             "cache": {"immutable_ttl": 0, "mutable_ttl": 0},
         },
         "pypi-test": {
-            "base_url": "https://pypi.org",
-            "type": "remote",
-            "package": "pypi",
-            "pypi_files_url": "https://files.pythonhosted.org",
-            "pypi_files_remote": "pypi-files-test",
-            "cache": {"immutable_ttl": 0, "mutable_ttl": 600},
-        },
-        "pypi-files-test": {
             "base_url": "https://files.pythonhosted.org",
             "type": "remote",
-            "package": "generic",
+            "package": "pypi",
             "immutable_patterns": [
-                "packages/.*\\.whl$",
-                "packages/.*\\.whl\\.metadata$",
-                "packages/.*\\.tar\\.gz$",
+                r"packages/.*\.whl$",
+                r"packages/.*\.whl\.metadata$",
+                r"packages/.*\.tar\.gz$",
             ],
-            "cache": {"immutable_ttl": 0, "mutable_ttl": 0},
+            "cache": {"immutable_ttl": 0, "mutable_ttl": 600},
         },
         "npm-test": {
             "base_url": "https://registry.npmjs.org",
             "type": "remote",
             "package": "npm",
-            "npm_files_url": "https://registry.npmjs.org",
-            "npm_files_remote": "npm-test",
             "immutable_patterns": [r"\.tgz$"],
             "mutable_patterns": [r"^(?!.*\.tgz$).*"],
             "cache": {"immutable_ttl": 0, "mutable_ttl": 600},

tests/test_routes.py

@@ -685,7 +685,7 @@ class TestPyPIRemote:
         response = client.get("/api/v1/remote/pypi-test/simple/requests/")
         assert response.status_code == 200
         assert b"files.pythonhosted.org" not in response.content
-        assert b"/api/v1/remote/pypi-files-test/packages/requests-2.31.0.tar.gz" in response.content
+        assert b"/api/v1/remote/pypi-test/packages/requests-2.31.0.tar.gz" in response.content
 
     def test_simple_index_content_type_is_html(self, client, patched_deps):
         deps = patched_deps
@@ -722,7 +722,7 @@ class TestPyPIRemote:
         deps["storage"].download_object.return_value = b"PK wheel bytes"
         deps["cache"].is_mutable_file.return_value = False
 
-        response = client.get("/api/v1/remote/pypi-files-test/packages/requests-2.31.0-py3-none-any.whl")
+        response = client.get("/api/v1/remote/pypi-test/packages/requests-2.31.0-py3-none-any.whl")
         assert response.status_code == 200
         assert "application/zip" in response.headers["content-type"]
         assert response.headers["X-Artifact-Source"] == "cache"
@@ -733,13 +733,13 @@ class TestPyPIRemote:
         deps["storage"].download_object.return_value = b"tar bytes"
         deps["cache"].is_mutable_file.return_value = False
 
-        response = client.get("/api/v1/remote/pypi-files-test/packages/requests-2.31.0.tar.gz")
+        response = client.get("/api/v1/remote/pypi-test/packages/requests-2.31.0.tar.gz")
         assert response.status_code == 200
         assert "application/gzip" in response.headers["content-type"]
 
-    def test_blocked_path_on_files_remote_returns_403(self, client, patched_deps):
-        """Paths that don't match immutable_patterns on pypi-files-test are blocked."""
-        response = client.get("/api/v1/remote/pypi-files-test/packages/requests.unknown")
+    def test_unknown_extension_on_pypi_remote_returns_403(self, client, patched_deps):
+        """Paths that don't match immutable_patterns and aren't mutable are blocked."""
+        response = client.get("/api/v1/remote/pypi-test/packages/requests.unknown")
         assert response.status_code == 403