STAT-133: Add NPM_TOKEN support to node and test/npm actions for private registry auth

npm ci fails with E401 when a consuming repo's package-lock.json pins a
package to the private Gitea npm registry, since these composite actions
never write an .npmrc or set a registry auth token. Add an optional
NPM_TOKEN input that writes .npmrc before install; existing consumers that
don't pass it are unaffected.

node/action.yml

@@ -25,6 +25,9 @@ inputs:
   UPLOAD_ARTIFACT:
     description: "Whether to upload the build artifact"
     default: "true"
+  NPM_TOKEN:
+    description: "Auth token for the private Gitea npm registry (@stat-tackler scope). Leave empty if the repo installs no private packages."
+    default: ""
 
 runs:
   using: composite
@@ -36,6 +39,16 @@ runs:
       with:
         node-version-file: ${{ inputs.WORKING_DIRECTORY }}/package.json
 
+    - name: Configure private registry auth
+      if: inputs.NPM_TOKEN != ''
+      shell: sh
+      working-directory: ${{ inputs.WORKING_DIRECTORY }}
+      run: |
+        printf '%s\n%s\n' \
+          '@stat-tackler:registry=https://gitea.pixelparasol.com/api/packages/stat-tackler/npm/' \
+          '//gitea.pixelparasol.com/api/packages/stat-tackler/npm/:_authToken=${{ inputs.NPM_TOKEN }}' \
+          >> .npmrc
+
     - name: Install
       shell: sh
       working-directory: ${{ inputs.WORKING_DIRECTORY }}