website/docs: document npm install-script blocking (#22461)

* website/docs: document npm install-script blocking

The repo's `.npmrc` sets `ignore-scripts=true` to neutralize the
dominant npm supply-chain attack pattern (preinstall/postinstall
payloads, as used by the recent "Shai-Hulud" and "Mini Shai-Hulud"
incidents). The trade-off is that a handful of packages that ship
native binaries — esbuild, chromedriver, tree-sitter — need to be
rebuilt explicitly when their install step is required.

Today this is implicit; a new contributor whose build fails because
esbuild's binary didn't unpack has no obvious next step except to
disable the protection. Documenting it in both setup guides points
them at `npm rebuild --foreground-scripts <pkg>` and makes the
"don't flip `ignore-scripts` off" guidance explicit.

No code or config changes — docs only.

Co-authored-by: Agent <279763771+playpen-agent@users.noreply.github.com>

* Use separate file.

* Apply suggestions from code review

Co-authored-by: Dewi Roberts <dewi@goauthentik.io>
Signed-off-by: Dewi Roberts <dewi@goauthentik.io>

---------

Signed-off-by: Dewi Roberts <dewi@goauthentik.io>
Co-authored-by: Agent <279763771+playpen-agent@users.noreply.github.com>
Co-authored-by: Dewi Roberts <dewi@goauthentik.io>

website/docs/developer-docs/contributing.md

@@ -120,7 +120,7 @@ When you are creating an enhancement suggestion, please fill in [the template](h
 
 authentik can be run locally, although depending on which part you want to work on, different prerequisites are required.
 
-This is documented in the [developer docs](./setup/frontend-dev-environment.md).
+This is documented in the [developer docs](./setup/frontend-dev-environment.mdx).
 
 ### Help with the docs
 

website/docs/developer-docs/setup/_npm-install-scripts-admonition.mdx

@@ -0,0 +1,11 @@
+:::info NPM install scripts are disabled by default
+The repository's NPM runtime configuration file (`.npmrc`) sets `ignore-scripts=true`. This means that `preinstall`/`install`/`postinstall` lifecycle scripts do not run during `npm ci`. This neutralizes a dominant NPM supply-chain attack pattern at the cost of skipping a few legitimate native-binary unpacks.
+
+If the watch build fails because a package needs its install script (commonly `esbuild`, `chromedriver`, `tree-sitter`, or `tree-sitter-json`), rebuild only that package, for example:
+
+```shell
+npm rebuild --foreground-scripts esbuild chromedriver tree-sitter tree-sitter-json
+```
+
+**Do not** edit `.npmrc` to flip `ignore-scripts` off — that re-introduces the risk repository-wide.
+:::

website/docs/developer-docs/setup/frontend-dev-environment.mdx

@@ -8,6 +8,8 @@ tags:
     - docker
 ---
 
+import NPMInstallScriptsAdmonition from "./\_npm-install-scripts-admonition.mdx";
+
 If you're focusing solely on frontend development, you can create a minimal development environment using Docker and Node.js. This setup allows you to make and preview changes to the frontend in real-time, without needing to interact with the backend.
 
 ### Prerequisites
@@ -55,6 +57,8 @@ If you're focusing solely on frontend development, you can create a minimal deve
     make web-watch
     ```
 
+    <NPMInstallScriptsAdmonition />
+
 5. In a new terminal, navigate to the cloned repository root and start the backend containers with Docker Compose.
 
     ```shell

website/docs/developer-docs/setup/full-dev-environment.mdx

@@ -11,6 +11,7 @@ tags:
 
 import TabItem from "@theme/TabItem";
 import Tabs from "@theme/Tabs";
+import NPMInstallScriptsAdmonition from "./\_npm-install-scripts-admonition.mdx";
 
 ## Prerequisites
 
@@ -126,6 +127,8 @@ Install all required JavaScript and Python dependencies and create an isolated P
 make install
 ```
 
+<NPMInstallScriptsAdmonition />
+
 ### Generate development configuration
 
 Create a local configuration file that uses the local databases for development: