ci: remove committed npm auth config

[albert20260301]

Summary

• remove the committed .npmrc that forces local npm commands to use ${NPM_TOKEN}
• revert release publishing back to bun publish
• pass the CI npm token through Bun's supported NPM_CONFIG_TOKEN env var instead of NODE_AUTH_TOKEN/setup-node

Impact

Local npm commands no longer fail with E401 when NPM_TOKEN is unset. Release publishing still receives the npm automation token in CI without committing registry auth config.

Verification

• bun install --frozen-lockfile
• bun run build
• NPM_CONFIG_TOKEN=dummy bun publish --dry-run --access public (packages/altertable-js)
• NPM_CONFIG_TOKEN=dummy bun publish --dry-run --access public (packages/altertable-react)
• git diff --check

[albert20260301]

@francoischalifour this removes the repo-level .npmrc that was breaking local npm auth when NPM_TOKEN is unset, and keeps Bun publishing in CI using NPM_CONFIG_TOKEN per Bun's publish auth support. Can you review when CI finishes?