fix: remove stale npm metadata for private packages

[bjohansebas]

When an indexed package becomes private, skipping npm requests leaves its previous PACKUMENT and PACKAGE_MANIFEST records in the database. Subsequent site builds still export the old packument in projects.json.

Delete both npm records in the same LevelDB batch that saves the private PACKAGE_JSON. Add regression coverage using a temporary LevelDB database for public-to-private transitions, repeated indexing, new private packages, preservation of other projects, exported project data, and restoration of npm metadata when a package becomes public again.

Validation:

• npm run lint
• npm test — 5 passing, including the integration suite. The indexer logs non-fatal errors for unavailable package metadata in the existing fixtures.
• Confirmed the public-to-private regression test fails against the previous implementation.