Bug: authenticated pulls always shows 0 on profile page

Description

Authenticated pulls count is always 0 on the profile page, even when logged-in users have pulled extensions.

Data flow

1. Download route (routes/api/v1/extensions/[...path].ts:163-196) — fires extension_pulled telemetry event with puller_user_id from ctx.state.user
2. Telemetry consumer (services/telemetry/lib/consumers/extensions.ts:51-62) — writes pull record to extension_pulls collection with pulledByUserId
3. Pull stats query (lib/infrastructure/mongo-extension-pull-repository.ts:45-82) — aggregates pulls, counts authenticated vs anonymous based on pulledByUserId != null
4. Profile page (routes/u/[username].tsx) — calls repo.getAuthorStats(username) and displays authenticatedPulls

Likely cause

Extension pulls happen via CLI tools (e.g. swamp pull extension-name), which likely don't send session cookies with the download request. Even if the user is logged into swamp.club in their browser, the CLI's HTTP request to /api/v1/extensions/{name}/{version}/download won't carry the browser session, so ctx.state.user is always null for pull requests → puller_user_id is always null → every pull is recorded as anonymous.

Possible fixes

• CLI auth: Have the CLI authenticate with an API token/key so pull requests carry user identity
• Query-param token: Pass a short-lived download token that identifies the user
• Accept that CLI pulls are anonymous and reconsider whether "authenticated pulls" is a meaningful metric to display, or remove it from the profile stats