Validate server registry urls are allowlisted for that registry type (#348)

## Summary
Closes a validation gap that allowed servers to be published with
unsupported registry types and base URLs.

## Changes
- **Registry Type Validation**: Only allow `npm`, `pypi`, `oci`,
`nuget`, `mcpb`
- **Registry Base URL Validation**: Enforce strict allowlist of official
registry URLs
- **Required Fields**: Registry type and base URL required when package
identifier provided
- **Comprehensive Tests**: Clear test structure showing valid vs invalid
cases side-by-side

## Validation Rules
- `npm` → `https://registry.npmjs.org`
- `pypi` → `https://pypi.org`
- `oci` → `https://docker.io` 
- `nuget` → `https://api.nuget.org`
- `mcpb` → `https://github.com` or `https://gitlab.com`

All other combinations are rejected with clear error messages.

internal/validators/constants.go

@@ -13,6 +13,11 @@ var (
 	// Remote validation errors
 	ErrInvalidRemoteURL = errors.New("invalid remote URL")
 
+	// Registry validation errors
+	ErrUnsupportedRegistryType      = errors.New("unsupported registry type")
+	ErrUnsupportedRegistryBaseURL   = errors.New("unsupported registry base URL")
+	ErrMismatchedRegistryTypeAndURL = errors.New("registry type and base URL do not match")
+
 	// Argument validation errors
 	ErrNamedArgumentNameRequired    = errors.New("named argument name is required")
 	ErrInvalidNamedArgumentName     = errors.New("invalid named argument name format")