feat: add npm build process, version bump, and forbidden token enforcement

- Add esbuild config to bundle CLI with all workspace code for npm publishing
- Add build-npm.sh script that runs forbidden token check, type-check,
  esbuild bundle, and generates publishable package.json
- Add generate-npm-package-json.mjs to resolve workspace:* refs to actual
  npm dependencies for publishing
- Add version-bump.sh for patch/minor/major/explicit version bumping
- Add check-forbidden-tokens.mjs that scans codebase for forbidden tokens
  (mirrors git hook logic, safe if token list is missing)
- Add esbuild as dev dependency
- Add build:npm, version:bump, check:tokens scripts to root package.json
- Update .gitignore for build artifacts

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

scripts/build-npm.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# build-npm.sh — Build the paperclipai CLI package for npm publishing.
+#
+# Uses esbuild to bundle all workspace code into a single file,
+# keeping external npm dependencies as regular package dependencies.
+#
+# Usage:
+#   ./scripts/build-npm.sh               # full build
+#   ./scripts/build-npm.sh --skip-checks  # skip forbidden-token check (CI without token list)
+
+REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+CLI_DIR="$REPO_ROOT/cli"
+DIST_DIR="$CLI_DIR/dist"
+
+skip_checks=false
+for arg in "$@"; do
+  case "$arg" in
+    --skip-checks) skip_checks=true ;;
+  esac
+done
+
+echo "==> Building paperclipai for npm"
+
+# ── Step 1: Forbidden token check ──────────────────────────────────────────────
+if [ "$skip_checks" = false ]; then
+  echo "  [1/5] Running forbidden token check..."
+  node "$REPO_ROOT/scripts/check-forbidden-tokens.mjs"
+else
+  echo "  [1/5] Skipping forbidden token check (--skip-checks)"
+fi
+
+# ── Step 2: TypeScript type-check ──────────────────────────────────────────────
+echo "  [2/5] Type-checking..."
+cd "$REPO_ROOT"
+pnpm -r typecheck
+
+# ── Step 3: Bundle CLI with esbuild ────────────────────────────────────────────
+echo "  [3/5] Bundling CLI with esbuild..."
+cd "$CLI_DIR"
+rm -rf dist
+
+node --input-type=module -e "
+import esbuild from 'esbuild';
+import config from './esbuild.config.mjs';
+await esbuild.build(config);
+"
+
+chmod +x dist/index.js
+
+# ── Step 4: Back up dev package.json, generate publishable one ─────────────────
+echo "  [4/5] Generating publishable package.json..."
+cp "$CLI_DIR/package.json" "$CLI_DIR/package.dev.json"
+node "$REPO_ROOT/scripts/generate-npm-package-json.mjs"
+
+# ── Step 5: Summary ───────────────────────────────────────────────────────────
+BUNDLE_SIZE=$(wc -c < "$DIST_DIR/index.js" | xargs)
+echo "  [5/5] Build verification..."
+echo ""
+echo "Build complete."
+echo "  Bundle: cli/dist/index.js (${BUNDLE_SIZE} bytes)"
+echo "  Source map: cli/dist/index.js.map"
+echo ""
+echo "To preview:   cd cli && npm pack --dry-run"
+echo "To publish:   cd cli && npm publish --access public"
+echo "To restore:   mv cli/package.dev.json cli/package.json"