[QUESTIONS and NOTES] Granular Access Tokens

1. I can generate them in the website. Then it lets me copy them from the webpage. Am I expected to set the ~/.npmrc file manually? npm login used to set this up for me. The docs have no clear section about "Using granular access tokens". Only about creating and viewing them.
2. According to the docs, the CLI cannot create such tokens. Is this still true as of 11.7.0? (aka I see a npm token create command)
3. Is the "Bypass 2FA" only for tokens with write access? If so, the token creation page isn't clear about that.
4. While write-allowed tokens have maximum of 90 days until expiration, read-only ones appear to not be limited this way (I can create tokens 1 year forward). Not super clear from the documentation and token creating page.
5. At the end of the blog post there's a small note about current tokens (ones that npm login creates) being limited to two hours. This was not clear at all and is easy to miss. Can the CLI be clear about that when creating such tokens?

Start with the linked access-token documentation and compare its guidance with the npm login and npm token create commands, including .npmrc setup and token expiration behavior. Clarify the documentation and CLI messaging for the five questions raised, with each token type and limitation explained; done means users can follow the workflow without relying on the blog post.