feat: full-stack MCP surface — client template, npm CI, 13 repos

- build.py: vendor templates/client into mcp/templates/client with
  client.json manifest (16 kinds); register drone-npm as a third CI shape
  (types: pypi/npm/docker); root *.py stale doc numbers fixed
- registry.py: registry://client resource + list_client_components /
  get_client_component / get_client_template tools; build prompt gains the
  client scaffold step (docs://modules/ui_admin); compliance prompt covers
  npm packages; drone docs describe all three shapes
- repos.json (+mcp): doc-weaver, react-auth, react-openapi (npm Type B,
  package.json version source), vet (app Type C, VERSION)
- docs: 90_drone_pipelines gains Type B npm section; 91_versioning covers
  package.json as a version source; 94_repository_inventory gains the npm
  package table and services/apps Type C; lib index updated

Verified: bundle regen (24 modules, client 16, drone 3, repos 13); registry
client readers exercised against the vendored bundle.

standards/src/lib/94_repository_inventory.md

@@ -5,7 +5,7 @@
 The canonical list of Aetos repositories covered by the CI and versioning
 standards, with the artifact each one produces, its version source, and its
 Drone shape. Every entry maps to the contract in
-[91 – Versioning & Changelog](91_versioning_and_changelog.md) and the two CI
+[91 – Versioning & Changelog](91_versioning_and_changelog.md) and the three CI
 files in [90 – Drone Pipelines](90_drone_pipelines.md).
 
 The same data is published machine-readably as the `registry://repos` MCP
@@ -14,7 +14,7 @@ Paths are relative to the `aetos/` workspace root.
 
 ---
 
-## Packages (Type A)
+## Packages (Type A — PyPI)
 
 A wheel + sdist published to the private index. Version source is
 `pyproject.toml`; Drone file is `python-lib.yaml` (tag-triggered).
@@ -32,14 +32,28 @@ A wheel + sdist published to the private index. Version source is
 
 ---
 
-## Services (Type B)
+## Packages (Type B — npm)
+
+A package published to the private npm registry (`npm.aetoskia.com`). Version
+source is `package.json`; Drone file is `npm-lib.yaml` (tag-triggered).
+
+| Repo | Path | Docs | MCP server |
+|------|------|------|------------|
+| `doc-weaver` | `doc-weaver` | lib, wiki | `doc-weaver:8010` |
+| `react-auth` | `react/react-auth` | lib, wiki | `react-auth:8011` |
+| `react-openapi` | `react/react-openapi` | lib, wiki | `react-openapi:8012` |
+
+---
+
+## Services & Apps (Type C)
 
 A container image pushed to the registry and run on the Docker host. Version
 source is the `VERSION` file; Drone file is `service-docker.yaml`.
 
-| Repo | Path | Trigger | Docs |
-|------|------|---------|------|
-| `auth-server` | `auth-server` | tag | api, lib, wiki |
+| Repo | Path | Type | Trigger | Docs |
+|------|------|------|---------|------|
+| `auth-server` | `auth-server` | service | tag | api, lib, wiki |
+| `vet` | `react/vet` | app | tag | lib, wiki |
 
 Tag-triggered and enforces `tag == VERSION`.
 
@@ -49,8 +63,9 @@ Tag-triggered and enforces `tag == VERSION`.
 
 | Type | Version source | Changelog | Drone |
 |------|----------------|-----------|-------|
-| package | `pyproject.toml` | `CHANGELOG.md` | `python-lib.yaml` |
-| service | `VERSION` | `CHANGELOG.md` | `service-docker.yaml` |
+| package (PyPI) | `pyproject.toml` | `CHANGELOG.md` | `python-lib.yaml` |
+| package (npm) | `package.json` | `CHANGELOG.md` | `npm-lib.yaml` |
+| service / app | `VERSION` | `CHANGELOG.md` | `service-docker.yaml` |
 
 Every covered repository must be able to satisfy `tag == version`:
 the version file (never a commit id) is bumped in the release MR, the MR is