Add everyone system user for anonymous registry pull.

Reserved PUBLIC ACLs can grant unauthenticated pull while blocking login, deletion, and anonymous push/delete.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/server/utils/system-users.ts

@@ -0,0 +1,5 @@
+export const EVERYONE_USERNAME = 'everyone'
+
+export function isEveryoneUsername(username: string): boolean {
+  return username.toLowerCase() === EVERYONE_USERNAME
+}