Add npm backfill pipeline, shared htpasswd registry auth docs

- drone npm template gains backfill-npm-from-tags (mirrors PyPI)
- document the shared /auth/htpasswd credential model (npm + PyPI +
  docker) and Verdaccio's bcrypt requirement
- point doc-weaver source/path at ../react/doc-weaver

standards/mcp/templates/drone/npm-lib.yaml

@@ -87,3 +87,70 @@ steps:
 trigger:
   event:
     - tag
+
+---
+kind: pipeline
+type: docker
+name: backfill-npm-from-tags
+
+platform:
+  os: linux
+  arch: arm64
+
+workspace:
+  path: /drone/src
+
+steps:
+  - name: fetch-tags
+    image: alpine/git
+    commands:
+      - git fetch --tags --force
+
+  - name: build-and-publish-missing
+    image: node:22-alpine
+    environment:
+      NPM_REPO_URL:
+        from_secret: NPM_REPO_URL
+      NPM_USERNAME:
+        from_secret: NPM_USERNAME
+      NPM_PASSWORD:
+        from_secret: NPM_PASSWORD
+    commands:
+      - apk add --no-cache git
+      - echo "registry=$NPM_REPO_URL" > /tmp/.npmrc
+      - echo "_auth=$(echo -n "$NPM_USERNAME:$NPM_PASSWORD" | base64 | tr -d '\n')" >> /tmp/.npmrc
+      - |
+        set -e
+
+        PACKAGE_NAME=$(node -p "require('./package.json').name")
+        echo "Package: $PACKAGE_NAME"
+
+        for TAG in $(git tag --sort=version:refname); do
+          VERSION="$TAG"
+          echo "Version: $VERSION"
+
+          if npm view "$PACKAGE_NAME@$VERSION" version --userconfig /tmp/.npmrc >/dev/null 2>&1; then
+            echo "Exists, skipping"
+            continue
+          fi
+
+          git checkout --force "$TAG"
+
+          TAG_VERSION=$(node -p "require('./package.json').version")
+          if [ "$TAG" != "$TAG_VERSION" ]; then
+            echo "Tag $TAG != package.json version $TAG_VERSION at that commit; skipping"
+            continue
+          fi
+
+          echo "Building $VERSION"
+          rm -rf dist
+          npm install
+          npm run build
+
+          echo "Publishing $VERSION"
+          npm publish --access restricted --userconfig /tmp/.npmrc
+        done
+
+trigger:
+  event:
+    - custom