Add NPM_TOKEN secret for @posit/shinyreact publishing

[schloerke]

The npm publish workflow (.github/workflows/release-js.yaml, added in #215) publishes @posit/shinyreact with provenance on js-v* tags or manual dispatch. It requires an NPM_TOKEN repository secret that does not exist yet.

Task

• Create an npm granular access token with publish rights for the @posit scope (@posit/shinyreact)
• Add it as the NPM_TOKEN repository secret (Settings → Secrets and variables → Actions)
• Verify with a first publish (tag js-v0.0.1 or workflow_dispatch)

Requires npm org access to the posit scope, so this needs a maintainer with those rights.

Blocks the first npm publish tracked in decisions/2026-08-17-js-distribution.md (#172).