release: 0.0.3, switched to npm trusted publishing (#101)

* version: 0.0.2

* Switch to npm trusted publishing (OIDC)

- Remove NPM_TOKEN secret requirement from npm-publish workflow
- Uses OIDC for authentication (more secure, no long-lived tokens)
- Update CONTRIBUTING.md with trusted publisher setup instructions

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* 0.0.3

---------

Co-authored-by: Claude <noreply@anthropic.com>

.github/workflows/npm-publish.yml

@@ -45,7 +45,7 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     if: github.event_name == 'release'
-    environment: release
+    environment: Release
     needs: [build, test]
 
     permissions:
@@ -80,6 +80,6 @@ jobs:
             echo "tag=" >> $GITHUB_OUTPUT
           fi
 
+      # Uses OIDC trusted publishing - no NPM_TOKEN needed
+      # Configure at: https://www.npmjs.com/package/@modelcontextprotocol/ext-apps/access
       - run: npm publish --provenance --access public ${{ steps.npm-tag.outputs.tag }}
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}