[feat] nopy update command and auto-update pipeline

.npmrc

@@ -0,0 +1,20 @@
+# The @bitsquare scope resolves from the Gitea registry rather than npmjs.
+#
+# Gitea is a strict superset: release.yml publishes there *and* to npmjs, while
+# publish-snapshot.yml pushes a `main` snapshot on every push. So this is not a
+# trade — it is every released version plus the ones npmjs has never seen, which
+# is what makes a snapshot testable before it is released.
+#
+# Scoped deliberately. A bare `registry=` would send all ~55 transitive
+# dependencies to Gitea too, and Gitea serves this scope only — it does not
+# proxy npmjs, so they would all 404. Everything outside @bitsquare keeps going
+# to the default registry.
+#
+# Reading is anonymous; no token belongs in this file. The publish workflows
+# write their credentials to a throwaway .npmrc-gitea / .npmrc-release, both of
+# which stay gitignored.
+#
+# Note this maps the *scope*, not a channel: Gitea currently publishes no
+# `latest` dist-tag, so an untagged `npm i @bitsquare/nopy` resolves to nothing.
+# Ask for a tag — @main for the newest snapshot. See README.PUBLISH.md.
+@bitsquare:registry=https://gitea.bitsquare.dev/api/packages/BitSquare/npm/