feat: publish @marketplaces/auth to private registry, drop local package copy

Stood up Verdaccio (Docker, on the dev server) as a private npm registry
since no public registry/NPM_TOKEN exists yet. Published @marketplaces/auth
and @marketplaces/payment there, removed the local packages/ staging copy
from this repo, and switched marketplaces to install @marketplaces/auth
0.1.0 as a real npm dependency through the registry.

- .npmrc scopes @marketplaces to the Verdaccio registry (no token committed;
  each installer/CI supplies its own via npm login or an env-injected token)
- Verified: fresh npm install, ng build, arch:check:boundaries, and full
  test suite (103/103) all pass against the registry-installed package
- Registry is reachable only via SSH tunnel today (firewall allows 80/443/
  SSH only); public/CI access is a follow-up decision, documented in
  docs/PACKAGE-EXTRACTION.md

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

package.json

@@ -22,7 +22,7 @@
   },
   "private": true,
   "dependencies": {
-    "@marketplaces/auth": "file:packages/auth",
+    "@marketplaces/auth": "0.1.0",
     "@angular/animations": "22.0.8",
     "@angular/cdk": "22.0.6",
     "@angular/common": "22.0.8",