Publishing to Ember Registry

POST /v1/applets/:id/releases accepts the signed .ember-applet bytes. Authenticate with Authorization: Bearer <publisher-token> and supply JSON release metadata in X-Ember-Release.

Required metadata: id, version, name, description, and publisher. Optional metadata: size, permissions, categories, and changelog.

The registry stores package bytes by SHA-256 and returns an immutable packageUrl plus sha256. Ember downloads that URL, checks its digest, and validates the applet signature before allowing installation.

For the reference server, set EMBER_PUBLISH_TOKEN and run npm run registry:dev. Put it behind HTTPS before making it public.