Building and governing a private npm registry: scope routing, _authToken configuration, CI publishing, GROUP aggregation with upstream caching, and troubleshooting E401/E404.