chore: migrate to the @j4k scope on the Forge npm registry

[Jercik]

Flips this repo off Verdaccio (npm.j4k.dev) onto the self-hosted Forgejo
npm registry (code.j4k.dev) as part of the Phase 4 migration.

What changed

• Dependency rename: oxlint-config-j4k → @j4k/oxlint-config (^2.11.0,
  the only version on the Forge). oxlint.config.ts is a managed file and was
  re-rendered by j4k-align --fix.
• Registry config (pnpm-workspace.yaml): registries.default →
  https://registry.npmjs.org/, plus "@j4k" → the Forge registry, with
  minimumReleaseAgeIgnoreMissingTime: false and an "@j4k/*"
minimumReleaseAgeExclude entry (the Forge omits time metadata).
• Workflows re-rendered current-gen: checks, dedupe-check, and
  release-npm install with secrets.FORGEJO_NPM_TOKEN against
  code.j4k.dev; pr-review passes FORGEJO_NPM_TOKEN into the
  Jercik/axgithub reusable as its NPM_TOKEN input.
• Toolchain floors bumped for @j4k/oxlint-config@2.11: oxlint
^1.72.0, oxlint-tsgolint ^0.23.0, oxfmt ^0.57.0.
• Lockfile rebuilt against the Forge (0 npm.j4k.dev references; the
  @j4k/oxlint-config tarball resolves from code.j4k.dev) and deduped.
• Lint fixes: the config jump surfaced new vitest rules; the mechanical
  rewrites were applied and the non-autofixable ones (max-expects,
  prefer-each, prefer-called-with, prefer-named-capture-group) were
  fixed by hand. In particular the prefer-called-with autofix rewrote three
  toHaveBeenCalled() assertions to a zero-arg toHaveBeenCalledWith()
  (which asserts the mock was called with no arguments); those were
  corrected to the mocks' real call arguments.
• The ambient types/css-modules.d.ts shim added by j4k-align is registered
  in knip.json's entry list so knip does not flag it as unused.

Secret note

The repo-scoped NPM_TOKEN secret is forbidden post-flip and has been
deleted; installs use the already-provisioned FORGEJO_NPM_TOKEN secret.
Any pre-flip branch/PR in this repo will fail its install step until this
PR merges to main and those branches are refreshed with main.

Known advisory breakage (not this PR's regression)

The PR Review draws will run red on this PR. pr-review delegates to
Jercik/axgithub/.github/workflows/pr-review.yml@v1, which is still the
pre-migration Verdaccio reusable; passing it FORGEJO_NPM_TOKEN as its
NPM_TOKEN input cannot authenticate against the old npm.j4k.dev install
step. This clears once the owner re-tags axgithub@v1 with the ported
reusable. pr-review is not a required status check.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a7df913f20

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep the prepare script cross-platform

On Windows developer machines, npm/pnpm lifecycle scripts run through cmd.exe by default, so this POSIX if ...; then ...; fi guard and /dev/null redirection are not parsed and pnpm install fails as soon as prepare runs. The previous direct git config command was shell-neutral; please move the guard into a small Node script or another cross-platform form.

Useful? React with 👍 / 👎.