CI: publish to npm via trusted publishing (OIDC)

[yyc1217]

Why

Token-based publishing has been failing: the npm token expired (causing the 404 "Not found"), and npm's 2025 policy tightened CI publishing. Trusted publishing (OIDC) removes tokens entirely — GitHub Actions authenticates to npm via short-lived OIDC tokens, so there's nothing to expire and 2FA no longer applies to the CI publish.

Changes (publish job)

• Add permissions: id-token: write so the job can mint an OIDC token.
• npm install -g npm@latest — trusted publishing requires npm CLI ≥ 11.5.1 (newer than what ships with Node 24).
• npm publish with no NODE_AUTH_TOKEN — npm detects the OIDC environment, authenticates automatically, and also attaches build provenance.

⚠️ Required one-time setup on npmjs.com (only you can do this)

Before this works, configure a trusted publisher for the package:

1. npmjs.com → twzipcode-vue → Settings → Trusted Publisher
2. Select GitHub Actions and fill in:
   • Organization/user: yyc1217
   • Repository: twzipcode-vue
   • Workflow filename: actions.yml
   • (Environment: leave blank — the job doesn't use a GitHub Environment)

Once that's saved and this PR is merged, push a tag (e.g. v3.0.1) to release — no token needed. You can also delete the now-unused NPM_TOKEN secret.

Note

package.json is still version 3.0.0 (never successfully published). If the next tag is v3.0.1, bump package.json to match — happy to do that in this PR or a follow-up.

Verification

• Workflow YAML parses; publish job has id-token: write, the npm upgrade step, and a tokenless npm publish.

---

Generated by Claude Code

[coveralls]

coverage: 91.946%. remained the same — npm-trusted-publishing into master