feat: publish @marketplaces/auth to private registry, drop local package copy

Stood up Verdaccio (Docker, on the dev server) as a private npm registry
since no public registry/NPM_TOKEN exists yet. Published @marketplaces/auth
and @marketplaces/payment there, removed the local packages/ staging copy
from this repo, and switched marketplaces to install @marketplaces/auth
0.1.0 as a real npm dependency through the registry.

- .npmrc scopes @marketplaces to the Verdaccio registry (no token committed;
  each installer/CI supplies its own via npm login or an env-injected token)
- Verified: fresh npm install, ng build, arch:check:boundaries, and full
  test suite (103/103) all pass against the registry-installed package
- Registry is reachable only via SSH tunnel today (firewall allows 80/443/
  SSH only); public/CI access is a follow-up decision, documented in
  docs/PACKAGE-EXTRACTION.md

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.npmrc

@@ -0,0 +1,10 @@
+# @marketplaces/* packages are published to a private Verdaccio registry on
+# the dev server (213.21.246.138:4873), not npmjs. The port isn't open in the
+# server firewall (only 80/443/SSH are) - reach it via an SSH tunnel:
+#   ssh -L 4873:127.0.0.1:4873 seto@213.21.246.138
+# See docs/PACKAGE-EXTRACTION.md for the full setup and the follow-up needed
+# to expose this properly for CI (reverse proxy + TLS, or open the port).
+@marketplaces:registry=http://127.0.0.1:4873/
+# Auth token is NOT committed here. Set it locally (npm login --registry=http://127.0.0.1:4873/
+# --scope=@marketplaces, or a user-level ~/.npmrc _authToken line) or via CI secret.
+