redesign auth callback page with branded card layout and dark mode

- Set version to 0.1.0 (pre-stable)
- Add prepublishOnly script to enforce build + test before publish
- Add publishConfig.access: public for scoped package
- Filter __tests__ from dist/data/ copy to avoid shipping test files

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

prepare for npm publish: version 0.1.0, add publish safeguards

Mirrors the elements publish flow: PR merged to main triggers build & test,
then a reviewer approves the publish via the npm-publish environment gate.
Version is read from npm and bumped from there (patch by default, override
with release:minor or release:major PR labels). Auth uses OIDC trusted
publishing — no NPM_TOKEN.

Also bumps ci.yml + package.json engines to Node 24 (LTS) and pnpm 10
to match the publish workflow.

Add release workflow with npm trusted publishing

The bin/unlayer symlink was a broken artifact from an old npm link
attempt — its target path didn't resolve and bin/ was excluded from
the published package via the "files" field. The "bin" field in
package.json is what actually registers the unlayer command on install.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

remove stale bin/ symlink