fix: cargo upstream proxy + mirror UX improvements (#107)

- Add CargoConfig with upstream proxy to crates.io (NORA_CARGO_PROXY)
- Cargo download/metadata: try local storage first, fetch from upstream on miss, cache in background
- Detect yarn.lock in npm subcommand and suggest correct command
- Add pip transitive dependency warning for air-gapped installs
- Improve mirror error messages with HTTP status codes

nora-registry/src/mirror/mod.rs

@@ -118,6 +118,15 @@ pub async fn run_mirror(
             packages,
             all_versions,
         } => {
+            if let Some(ref lf) = lockfile {
+                let content = std::fs::read_to_string(lf)
+                    .map_err(|e| format!("Cannot read {}: {}", lf.display(), e))?;
+                if content.contains("# yarn lockfile v1")
+                    || content.starts_with("# THIS IS AN AUTOGENERATED FILE")
+                {
+                    return Err("This looks like a yarn.lock file. Use `nora mirror yarn --lockfile` instead.".to_string());
+                }
+            }
             npm::run_npm_mirror(
                 &client,
                 registry,
@@ -269,7 +278,19 @@ async fn mirror_lockfile(
                 }
                 fetched += 1;
             }
-            _ => failed += 1,
+            Ok(r) => {
+                eprintln!(
+                    "  WARN: {} {} -> HTTP {}",
+                    target.name,
+                    target.version,
+                    r.status()
+                );
+                failed += 1;
+            }
+            Err(e) => {
+                eprintln!("  WARN: {} {} -> {}", target.name, target.version, e);
+                failed += 1;
+            }
         }
 
         pb.set_message(format!("{}@{}", target.name, target.version));
@@ -277,6 +298,11 @@ async fn mirror_lockfile(
     }
 
     pb.finish_with_message("done");
+    if format == "pip" && fetched > 0 {
+        eprintln!(
+            "  NOTE: Only top-level packages were mirrored. For air-gapped installs,\n               use `pip freeze > requirements.txt` to include all transitive dependencies."
+        );
+    }
     Ok(MirrorResult {
         total: targets.len(),
         fetched,