fix(ci): NPM_TOKEN auth fallback for npm publish (#97)

## Summary

Switch npm publish from OIDC Trusted Publisher to granular access token
auth. Three publish attempts on v0.4.7 (and one each on prior tags going
back to v0.4.1) returned the same 404 from npm — Trusted Publisher setup
wouldn't take regardless of how the UI was configured. The token path is
documented, reliable, and what npm uses in practice.

## What changes

\`\`\`diff
       - name: Publish to npm
         run: npm publish --provenance --access public
+        env:
+          NODE_AUTH_TOKEN: \${{ secrets.NPM_TOKEN }}
\`\`\`

Two lines added. \`actions/setup-node\` already configures
\`registry-url\` to npm, so \`NODE_AUTH_TOKEN\` is the conventional way
to pass auth.

## Provenance is preserved

The \`--provenance\` flag still works under token auth. The workflow's
\`permissions: id-token: write\` is unchanged, so \`npm publish
--provenance\` still generates a sigstore attestation inside the GitHub
Actions OIDC environment. Token auth handles the upload; provenance
attests what was published — these are separate.

## Prerequisite (owner action, done in parallel)

A repo secret \`NPM_TOKEN\` must exist before this lands and the next
re-tag fires the workflow. The token should be a **granular access
token** scoped to:
- Packages: \`@hyperpolymath/boj-server\` only
- Permissions: Read and write

Created at https://www.npmjs.com/settings/~/tokens/granular/new.

## JSR path unchanged

JSR Trusted Publisher works (v0.4.7 published successfully on the
previous workflow run). The \`publish-jsr\` job is untouched.

## Sequencing

Merge → user re-tags v0.4.7 → workflow uses NPM_TOKEN → npm gets 0.4.7.
Glama re-scan window opens once the npm tarball is visible.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/publish.yml

@@ -40,6 +40,8 @@ jobs:
 
       - name: Publish to npm
         run: npm publish --provenance --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
   publish-jsr:
     name: Publish to JSR