Document npm registry endpoints and auth gotchas

Add the exact pip/npm registry endpoints and secret names, the
scope-scoped (not global) registry requirement given Verdaccio's missing
uplink, the host-scoped _auth rule, the per-item Drone shell caveat, and
the Verdaccio storage uid/permissions gotcha behind the confusing
"404 no such package available" error on publish.

standards/lib/90_drone_pipelines/index.html

@@ -753,8 +753,13 @@ pipelines</strong>:</p>
      the disaster-recovery / replay path.</li>
 </ol>
 <p>Secrets: <code>NPM_REPO_URL</code>, <code>NPM_USERNAME</code>, <code>NPM_PASSWORD</code>. Auth is a generated
-<code>.npmrc</code> (<code>registry=</code> + <code>_auth=</code> base64 of <code>user:pass</code>) written from secrets at
-runtime — the committed <code>.npmrc</code> in a repo only points at the registry URL.</p>
+<code>.npmrc</code> written from secrets at runtime. It sets a <strong>scope-scoped</strong> registry,
+never a global one — <code>@aetoskia:registry=$NPM_REPO_URL</code> — plus a host-scoped
+auth line <code>//&lt;host&gt;/:_auth=&lt;base64(user:pass)&gt;</code>. The scope and host are derived
+from <code>package.json</code> and <code>NPM_REPO_URL</code> respectively. A global <code>registry=</code> would
+push public transitive deps through Verdaccio (which has no uplink) and 404
+<code>npm install</code>; a bare <code>_auth=</code> is rejected by modern npm. See
+<a href="../93_library_registry/">93 – Library Registry</a>.</p>
 <ul>
 <li><strong>Ship as-is.</strong> Name and version come from <code>package.json</code>, so the same file
   is reused verbatim across every npm package.</li>