ci(release): publish to npm through trusted publishing only

[yannelli]

@yannelli/paseo-be-concise now has a trusted publisher for release.yml (npm trust list shows a GitHub entry with publish permission). This PR removes NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} from the Publish npm package step, so the workflow publishes through OIDC and holds no npm token. The job already grants id-token: write, and CI runs npm 11.19.0.

docs/npm-publishing.md, docs/INDEX.md, and the README Releases section now describe OIDC-only publishing. The doc also lists the npm trust commands to replace the entry if the workflow file is renamed.

Merging this PR does not publish to npm, because ci: does not trigger a release. The first OIDC publish happens on the next feat, fix, perf, revert, or breaking-change merge. If that publish fails, fix the trust entry and rerun Release; the step publishes any version missing from npm.

After the first OIDC publish succeeds, delete the NPM_TOKEN repository secret and set the package's Publishing access to require 2FA and disallow tokens.

Testing

• YAML parse of .github/workflows/release.yml
• grep finds no remaining NPM_TOKEN reference
• OIDC publish is not checked yet; it runs on the next release