docs: document the current state of npm access

[MarshallOfSound]

This doc has been "an ideal state" for a while and it's close to what we have but not exact so let's fix it.