@polka-ui/config: a postinstall that announces itself, then drops Sliver

It stamps its own payload 'authorized testing only,' then — past the Russian comments — exfils every npmrc and env secret and drops a real Go Sliver implant beaconing to a Russian host; the PoC label is the alibi.