feat!: publish as @dsh-plugin/session-delete with an automated Gitea npm release

The registry owner is the scope the package must publish under, so the name moves from @local/ to @dsh-plugin/ in all three places that must agree: package.json, cordis.patch.yml, and the client module id. `private` goes away because npm refuses to publish such a package, and publishConfig pins the registry to this organization's npm endpoint.

The tag workflow publishes whatever version the pushed v* tag names, using the built-in Gitea job token, and refuses a tag that disagrees with package.json.

index.js

@@ -27,7 +27,7 @@
  * Fetch route registered below; it is the only cross-half entry point this
  * package needs.
  *
- * @module @local/dsh-session-delete
+ * @module @dsh-plugin/session-delete
  */
 import { createHash } from 'node:crypto'
 import { lstat, open, readdir, readFile, rm, stat, writeFile } from 'node:fs/promises'