feat!: publish as @dsh-plugin/session-delete with an automated Gitea npm release

The registry owner is the scope the package must publish under, so the name moves from @local/ to @dsh-plugin/ in all three places that must agree: package.json, cordis.patch.yml, and the client module id. `private` goes away because npm refuses to publish such a package, and publishConfig pins the registry to this organization's npm endpoint.

The tag workflow publishes whatever version the pushed v* tag names, using the built-in Gitea job token, and refuses a tag that disagrees with package.json.

client.js

@@ -11,7 +11,7 @@
  * `--dsw-*` theme-token references. React comes from the page's module table.
  */
 window.__ModuleLoader__.load({
-  id: '@local/dsh-session-delete',
+  id: '@dsh-plugin/session-delete',
   factory(require) {
     const React = require('react')
     const h = React.createElement