Add npm backfill pipeline, shared htpasswd registry auth docs

- drone npm template gains backfill-npm-from-tags (mirrors PyPI)
- document the shared /auth/htpasswd credential model (npm + PyPI +
  docker) and Verdaccio's bcrypt requirement
- point doc-weaver source/path at ../react/doc-weaver

standards/lib/93_library_registry/index.html

@@ -626,6 +626,15 @@
     </span>
   </a>
   
+</li>
+      
+        <li class="md-nav__item">
+  <a href="#publishing-registry-auth" class="md-nav__link">
+    <span class="md-ellipsis">
+      Publishing &amp; registry auth
+    </span>
+  </a>
+  
 </li>
       
         <li class="md-nav__item">
@@ -821,6 +830,15 @@ matching library, its import name, its "use instead of" guidance, and its MCP
 endpoint (or, for the auth-server service, a spec pointer). It also serves the
 pinned auth-server OpenAPI contract at <code>docs://spec</code>. Query it before writing
 any infrastructure.</p>
+<h2 id="publishing-registry-auth">Publishing &amp; registry auth</h2>
+<p>Python packages publish to the private index (<code>pip.aetoskia.com</code>, <code>pypiserver</code>)
+and npm packages to the private registry (<code>npm.aetoskia.com</code>, Verdaccio). Both
+authenticate against the <strong>same <code>htpasswd</code> file</strong> (<code>/auth/htpasswd</code>) used by the
+Docker registry and the Traefik basic-auth middleware; registration is disabled,
+so the CI credentials (<code>PIP_USERNAME</code> / <code>PIP_PASSWORD</code>, <code>NPM_USERNAME</code> /
+<code>NPM_PASSWORD</code>) are one and the same account — there is no separate npm user.
+Verdaccio requires <strong>bcrypt</strong> htpasswd entries; see
+<a href="../90_drone_pipelines/">90 – Drone Pipelines</a> for the CI wiring.</p>
 <h2 id="notes">Notes</h2>
 <ul>
 <li><strong>Hexa</strong> is a full library with its own MCP server on <code>:8008</code>: read