[DRAFT] Add NPM publish canary token support

[pirate]

Summary

• add a minimal provider-backed npm publish canary token type
• let users download a matching canary workspace zip for npm publish flows
• poll the npm registry for the expected package version and alert/revoke on publish

Key Changes

• canarytokens/models/npm_publish.py
• canarytokens/npmtokens.py
• canarytokens/models/common.py
• canarytokens/models/init.py
• canarytokens/canarydrop.py
• canarytokens/queries.py
• canarytokens/settings.py
• frontend/app.py

---

Would love help testing this / making sure it works in all cases.

[pirate]

need to change these still, just placeholders for now