#280 Fix vulnerable tar dependency in PRPM CLI

Summary

• Upgrade the CLI and registry to tar 7.5.22 to address the advisories shown during global CLI installation.
• Upgrade registry bcrypt to 6.0.0, removing its transitive tar 6 dependency.
• Align the CLI Node requirement, build target, and installation guide at Node 18+.
• Verify that bcrypt 6 accepts a password hash generated with bcrypt 5.1.1.

Verification

• npm ls tar --all resolves only tar 7.5.22.
• Production npm audit reports no tar finding.
• CLI typecheck and build pass; 56 focused archive/install/show tests pass.
• Registry typecheck and build pass; package route tests pass (11 passed, 4 skipped); bcrypt compatibility test passes.
• Veto diff review passes on all 6 changed files with no security or secrets findings.

The registry auth test file currently has 14 failing assertions against its route contract (for example, it expects a 201 registration response while the route returns 200, and sends identifier while the route requires email). Those files are unchanged in this PR.