fix: correct package entry points and publish contents

Five packaging defects, all pre-existing:

1. dist/esm/index.js held ESM syntax while the package is not
   "type": "module", so Node classified it as CommonJS. It failed
   outright on Node 18 ("Unexpected token 'export'") and only worked on
   Node >= 22 because Node re-parses after guessing the module type,
   paying that cost on every import. Bundles now carry explicit
   extensions: .mjs for ES output, .cjs/.js for CommonJS. The browser
   build gained a real CommonJS output too — the exports map previously
   pointed the browser "require" condition at an ES module.
   The exports map now also leads with "types" and ends with a "default"
   fallback for resolvers matching neither "node" nor "browser".

2. files: ["native"] published the local build directory: a 94.6 kB
   Linux-x64 .node binary, a 148 kB object file and generated Makefiles.
   node-gyp-build checks build/Release before prebuilds, so every
   consumer on every platform would have found this machine's binary,
   skipped compiling, and failed to load it. It fails safe (native/
   index.js catches and returns null), but the addon could never work
   for anyone else. Narrowed to the four source files.

3. binding.gyp resolves node-addon-api at build time, but nothing
   declared it: it was a devDependency of the root, absent from
   native/package.json. The build only succeeded here because a dev
   install populates the root node_modules. Declared as a dependency of
   the native package, where it is actually needed.

4. No clean step, so stale output shipped — the tarball carried both
   dist/types/core/** and a dist/types/src/** tree left over from before
   rootDir was set. build now runs clean first.

5. test:browser ran `karma start` with no karma.conf.js anywhere in the
   repo, and tests/browser is an empty directory. Removed the script and
   the karma devDependency rather than leave a script that cannot run.

Verified: CommonJS require and ESM import both resolve on Node 18.19.1
and 24.18.0; TypeScript resolves types under both bundler and node16;
npm pack now produces 35 files / 103.8 kB with no build artefacts.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

doc/getting-started.md

@@ -244,7 +244,7 @@ In browsers, keys are kept in memory only (no file system). Everything else is i
 
 ```html
 <script type="module">
-  import { SecureChatCompletion } from 'https://unpkg.com/nomyo-js/dist/browser/index.js';
+  import { SecureChatCompletion } from 'https://unpkg.com/nomyo-js/dist/browser/index.mjs';
 
   const client = new SecureChatCompletion({
     baseUrl: 'https://api.nomyo.ai',