feat: make gateway publishable + add npmjs publish script

- Remove `private: true` from gateway package.json
- Add bin entry (mosaic-gateway), files array, npmjs publishConfig
- Add shebang to main.ts for bin execution
- New scripts/publish-npmjs.sh that patches @mosaic/* → @mosaicstack/*,
  resolves workspace deps to real versions, publishes to npmjs, restores
- Add publish-npmjs CI step in Woodpecker (runs on tags only)
- Update Gitea publish step comments for clarity

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.woodpecker/publish.yml

@@ -35,8 +35,8 @@ steps:
       - |
         echo "//git.mosaicstack.dev/api/packages/mosaic/npm/:_authToken=$NPM_TOKEN" > ~/.npmrc
         echo "@mosaic:registry=https://git.mosaicstack.dev/api/packages/mosaic/npm/" >> ~/.npmrc
-      # Publish all non-private packages (--no-git-checks skips dirty/branch checks in CI)
-      # --filter excludes private apps (gateway, web) and the root
+      # Publish non-private packages to Gitea (--no-git-checks skips dirty/branch checks in CI)
+      # --filter excludes gateway (published to npmjs instead) and web (private)
       - >
         pnpm --filter "@mosaic/*"
         --filter "!@mosaic/gateway"
@@ -46,6 +46,20 @@ steps:
     depends_on:
       - build
 
+  publish-npmjs:
+    image: *node_image
+    environment:
+      NPM_TOKEN:
+        from_secret: npmjs_token
+    commands:
+      - *enable_pnpm
+      - apk add --no-cache jq bash
+      - bash scripts/publish-npmjs.sh
+    depends_on:
+      - build
+    when:
+      - event: [tag]
+
   build-gateway:
     image: gcr.io/kaniko-project/executor:debug
     environment: