317e5230b6
npm audit fix - 13 advisories incl. astro high and tar critical, all non-breaking, gates re-run green locally. The dist secret scan greps password-adjacent patterns, so the post now says htpasswd file (which the registry auth actually is), credential vault, and lock-of-its-own.