build: move from pnpm to npm

Replace pnpm-lock.yaml with package-lock.json. The seven security overrides
move to package.json#overrides, including the two version-scoped
brace-expansion entries, which npm resolves per major branch the same way
pnpm did.

pnpm-workspace.yaml's allowBuilds becomes package.json#allowScripts: npm 11
gates dependency install scripts the same way, so sharp and unrs-resolver stay
explicitly approved rather than silently enabled.

.gitignore

@@ -28,7 +28,7 @@
 npm-debug.log*
 yarn-debug.log*
 yarn-error.log*
-.pnpm-debug.log*
+.npm-debug.log*
 
 # env files (can opt-in for committing if needed)
 .env*

README.md

@@ -16,13 +16,13 @@ This is a [Next.js](https://nextjs.org) project bootstrapped with [`create-next-
 
 ## Getting Started
 
-Requires Node.js 24+ and pnpm 11+.
+Requires Node.js 24+ and npm.
 
 First, run the development server:
 
 ```bash
-pnpm install
-pnpm dev
+npm install
+npm run dev
 ```
 
 Open [http://localhost:3000](http://localhost:3000) with your browser to see the result.

package.json

@@ -1,7 +1,6 @@
 {
   "name": "exchange-rate-export",
   "version": "0.1.0",
-  "packageManager": "pnpm@11.1.1",
   "private": true,
   "scripts": {
     "dev": "next dev --turbopack",
@@ -27,7 +26,20 @@
     "eslint-config-next": "16.2.11",
     "tailwindcss": "^4"
   },
+  "overrides": {
+    "@babel/core": "7.29.6",
+    "form-data": "4.0.6",
+    "js-yaml": "4.3.0",
+    "postcss": "8.5.18",
+    "sharp": "0.35.0",
+    "brace-expansion@1": "1.1.16",
+    "brace-expansion@5": "5.0.7"
+  },
   "engines": {
     "node": ">=24"
+  },
+  "allowScripts": {
+    "sharp": true,
+    "unrs-resolver": true
   }
 }

pnpm-workspace.yaml

@@ -1,16 +0,0 @@
-overrides:
-  '@babel/core': 7.29.6
-  form-data: 4.0.6
-  js-yaml: 4.3.0
-  postcss: 8.5.18
-  # next 16.2.11 declares sharp ^0.34.5, which excludes the patched 0.35.0, so
-  # no upstream bump can reach the fix -- force it here.
-  sharp: 0.35.0
-  # Two independent major branches reach this package: minimatch@3 pulls 1.x,
-  # minimatch@10 pulls 5.x. Each branch needs its own patched version.
-  'brace-expansion@1': 1.1.16
-  'brace-expansion@5': 5.0.7
-
-allowBuilds:
-  sharp: true
-  unrs-resolver: true