feat: publish to NPM instead of JSR

[coderbyheart]

Publishes this package to NPM instead of JSR.

Why

JSR packages are consumed through JSR's NPM compatibility layer, as
npm:@jsr/nrfcloud__… aliases that resolve to tarball URLs on npm.jsr.io.
NPM v12 classifies those as remote fetches and refuses them unless
allow-remote is set. allow-remote=root only covers a project's own top-level
dependencies — as soon as one of them pulls in a transitive JSR dependency,
every host project consuming it has to relax the setting to
allow-remote=all.

That is not a per-dependency exemption: it permits fetching arbitrary remote
tarballs anywhere in the dependency tree, for every dependency of the host
project, bypassing the registry. That is a large attack surface to open up in
every consuming project just to distribute a handful of internal libraries.

Publishing to NPM removes the need for it entirely: these packages become
ordinary registry dependencies.

What changed

• jsr.json is removed.
• semantic-release now uses @semantic-release/npm (and
  @semantic-release/github, so a GitHub release is created as well) instead of
  @sebbo2002/semantic-release-jsr. The ad-hoc
  npm install -D @sebbo2002/semantic-release-jsr in the workflow is gone; both
  plugins ship with semantic-release.
• actions/setup-node sets registry-url: https://registry.npmjs.org so
  @semantic-release/npm can authenticate.
• A prepublishOnly hook builds the published artifacts into npm/, following
  nRFCloud/billing-service-proto:
  1. .npm/compile.ts transpiles the TypeScript sources with
     @swc/core and rewrites .ts
     import specifiers to .js.
  2. TypeScript 7 emits the type
     declarations using .npm/tsconfig.npm.json.
• exports points at the compiled output in npm/, files limits the tarball
  to npm and README.md, and npm/ is gitignored.
• tsconfig.json gains "include": ["./**/*.ts", "./.npm/*.ts"]. TypeScript's
  default include glob skips dot-directories, so without this the new build
  scripts would never be type-checked. "exclude": ["npm/**/*"] keeps the
  generated output out of the type check, and "types": ["node"] is needed
  because the build scripts use Node.js built-ins.
• README/CONTRIBUTING point at NPM instead of JSR.

Verified locally

npx tsc, npm test and npm run prepublishOnly all pass. The resulting
tarball was installed into a scratch project, where the package type-checks
under TypeScript 7 and imports at runtime.

Needs doing on the NPM side before this can release

The @nrfcloud scope needs to accept this package name. Publishing relies on
npm trusted publishing (the
workflow already grants id-token: write and passes no NODE_AUTH_TOKEN to the
release step), so a trusted publisher for this repository has to be configured
on npmjs.com — or the release step needs an NPM_TOKEN.

publishConfig.access is set to public, which keeps the package as publicly
available as it was on JSR. Change it to restricted if it should become
private instead.

Follow-up

This repo still consumes other nRF Cloud libraries through their JSR
npm-compatibility aliases (npm:@jsr/nrfcloud__…). Those are left untouched
here, because the NPM versions of those packages do not exist until their own
migration PRs have been merged and released. Once they have, a follow-up PR
should switch them to plain @nrfcloud/… NPM dependencies (and drop
@jsr:registry from .npmrc).

[coderbyheart]

Security fix, no review required.