fix: add Verdaccio auth token + npm install retry for CI

- Create a CI user on Verdaccio via CouchDB API and set _authToken before
  publishing patched tarballs (fixes ENEEDAUTH)
- Retry npm install up to 3 times with 15s delay for transient ECONNRESET

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/actions/setup-npm/action.yml

@@ -55,6 +55,19 @@ runs:
         timeout 30 bash -c 'until curl -sf http://localhost:4873/-/ping >/dev/null 2>&1; do sleep 1; done'
         echo "Verdaccio ready"
 
+        # Create a CI user on Verdaccio and get an auth token
+        RESPONSE=$(curl -s -XPUT http://localhost:4873/-/user/org.couchdb.user:ci \
+          -H "Content-Type: application/json" \
+          -H "Accept: application/json" \
+          -d '{"name":"ci","password":"ci","email":"ci@localhost","type":"user"}')
+        TOKEN=$(echo "$RESPONSE" | python3 -c "import json,sys; print(json.load(sys.stdin).get('token',''))" 2>/dev/null)
+        if [ -z "$TOKEN" ]; then
+          echo "Warning: could not get Verdaccio token, publish may fail"
+        else
+          npm set //localhost:4873/:_authToken="$TOKEN"
+          echo "Verdaccio auth configured"
+        fi
+
         # Publish all patched tarballs
         PATCHES_DIR="deployment/npm-patches"
         for tarball in "$PATCHES_DIR"/*.tgz; do
@@ -69,4 +82,10 @@ runs:
 
     - name: Install npm dependencies
       shell: bash
-      run: npm install
+      run: |
+        # Retry npm install up to 3 times for transient network failures
+        for attempt in 1 2 3; do
+          npm install && break
+          echo "npm install attempt $attempt failed, retrying in 15s..."
+          sleep 15
+        done