fix: encode scoped package names as a single path segment

pkgPath now URL-encodes the package name so @babel/core becomes a single
%40babel%2Fcore segment in manifest, files and downloads endpoints.
Equivalent on npmmirror today and robust against registries that expect
the scoped name to be encoded.

Author: thonatos

apps/web/app/lib/registry/client.ts

@@ -31,7 +31,7 @@ async function registryJson<T>(path: string, init?: RequestInit): Promise<T> {
 }
 
 function pkgPath(pkg: string) {
-  return pkg;
+  return encodeURIComponent(pkg);
 }
 
 function ensureLeadingSlash(path: string) {