How to use a private registry with pnpm and Yarn: .npmrc, .yarnrc.yml, where tokens go, and new packages getting blocked

One private npm registry, three different configs: pnpm 12, Yarn 1, and Yarn 4. Where registry URLs and tokens belong, why pnpm ignores ${NPM_TOKEN} in a project .npmrc, and why freshly published internal packages get held back.