Add npm backfill pipeline, shared htpasswd registry auth docs

- drone npm template gains backfill-npm-from-tags (mirrors PyPI)
- document the shared /auth/htpasswd credential model (npm + PyPI +
  docker) and Verdaccio's bcrypt requirement
- point doc-weaver source/path at ../react/doc-weaver

standards/wiki/04_development/02_releasing/index.html

@@ -1011,9 +1011,10 @@ commit, and move the tag <strong>only</strong> if it was never pushed.</p>
 <p>If an older tag never published (a past version-file mismatch, an index
 outage):</p>
 <ul>
-<li><strong>Package:</strong> run the <code>backfill-pypi-from-tags</code> pipeline (custom event). It
-  checks out every tag, verifies <code>tag == pyproject version</code> at that commit,
-  and uploads the ones missing from the index. Already-fixed history is never
+<li><strong>Package:</strong> run the matching <code>backfill-*-from-tags</code> pipeline (custom event) —
+  <code>backfill-pypi-from-tags</code> for Python, <code>backfill-npm-from-tags</code> for npm. It
+  checks out every tag, verifies <code>tag ==</code> the version file at that commit, and
+  uploads the ones missing from the index. Already-fixed history is never
   rewritten.</li>
 <li><strong>Service:</strong> rebuild the image for the missing tag with a fresh commit and a
   new patch version; do not move a published tag.</li>