chore(ci): switch publish to OIDC trusted publishing

Drops NPM_TOKEN/NODE_AUTH_TOKEN from the publish job. npm CLI
auto-detects GitHub Actions OIDC (id-token: write was already present
from #1836) and exchanges for a short-lived publish credential.

Also drops registry-url from setup-node — it writes a .npmrc expecting
NODE_AUTH_TOKEN, which short-circuits before OIDC kicks in. npm
defaults to npmjs.org without it.

Requires trusted publishers configured per-package on npmjs.com:
client/server/express/hono/node/fastify → workflow release.yml,
environment release.

Author: felixweinberger

.github/workflows/release.yml

@@ -63,7 +63,6 @@ jobs:
                   node-version: 24
                   cache: pnpm
                   cache-dependency-path: pnpm-lock.yaml
-                  registry-url: 'https://registry.npmjs.org'
 
             - name: Install dependencies
               run: pnpm install
@@ -74,6 +73,4 @@ jobs:
                   publish: pnpm run ci:publish
               env:
                   GITHUB_TOKEN: ${{ github.token }}
-                  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-                  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
                   NPM_CONFIG_PROVENANCE: 'true'