feat: release OTP and Passkey Tools 0.1.0

THIRD_PARTY_NOTICES.md

@@ -0,0 +1,24 @@
+# Third-party notices
+
+The release preparation step collates licence files for the exact locked runtime packages into `LICENSES/npm-runtime-licenses.txt` inside the static artifact.
+
+## Direct runtime packages
+
+| Package                          | Version | Licence    | Role                            | Source                                      |
+| -------------------------------- | ------- | ---------- | ------------------------------- | ------------------------------------------- |
+| `@add-ideas/toolbox-contract`    | 0.2.3   | Apache-2.0 | manifest and context contract   | https://git.add-ideas.de/lotobo/toolbox-sdk |
+| `@add-ideas/toolbox-shell-react` | 0.2.3   | Apache-2.0 | shared shell, theme and actions | https://git.add-ideas.de/lotobo/toolbox-sdk |
+| `react`                          | 19.2.6  | MIT        | application UI                  | https://github.com/facebook/react           |
+| `react-dom`                      | 19.2.6  | MIT        | browser rendering               | https://github.com/facebook/react           |
+
+`scheduler`, distributed by the React project under MIT, is the only transitive runtime package.
+
+## QR construction
+
+`src/qr/encoder.ts` is a bounded TypeScript rewrite following the QRCode for JavaScript construction algorithm by Kazuhiko Arase (copyright 2009), used under the MIT License. The licence text is in `LICENSES/QRCode-MIT.txt`. The rewrite supports byte mode, error correction M, versions 1–10, and contains no upstream branding or UI.
+
+## Standards material
+
+RFC interoperability values are facts used as tests. The OCRA implementation is project-authored from RFC 6287; its Java reference implementation is not shipped. W3C WebAuthn, IETF CBOR/COSE and OTP specifications are implementation references, not bundled runtime software.
+
+Development-only packages listed in `package-lock.json` build and test the source but are not shipped as runtime modules.