Decide whether hosted packages stay in the proxy #560

/api/hosted and proxy hosted push (#464, #537) let you push npm, Composer and generic packages into the proxy. Pushed files are stored as source='local' and never evicted, and npm and Composer metadata merge the pushed versions into upstream responses. That makes the proxy hold data it can't refetch from anywhere, unlike the rest of the cache.

As said in #542, I'd like the proxy to stay stateless apart from its cache as much as possible. The options I can see:

• Keep it as it is, with no new ecosystems or auth.
• Deprecate it and point people at running a registry that the proxy routes to (Feature proposal: multiple upstreams, with optional masking #55).

The one thing routing can't replace is serving a patched build of a single upstream version, which was the original use case in #133. If people rely on that, it's a reason to keep it.