Fix missing NODE_AUTH_TOKEN in npm publish workflow step

[Copilot]

The build-publish-npm job was failing with npm error 404 Not Found - PUT https://registry.npmjs.org/@kwiz%2fcommon because npm publish was running unauthenticated. When actions/setup-node is configured with registry-url, it wires up an .npmrc that reads from NODE_AUTH_TOKEN — but that env var was never passed to the publish step.

Change

• .github/workflows/npm-publish.yml: Add NODE_AUTH_TOKEN env var to the npm publish step, sourced from the NPM_TOKEN repository secret.

- run: npm publish --access public
  env:
    NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}