build: move web/ from pnpm to npm

Replace pnpm-lock.yaml with package-lock.json. The three security overrides
move from pnpm-workspace.yaml to package.json#overrides, where npm reads them
natively. Only the postcss floor is still live; @babel/core and js-yaml left
the tree with Next.js but are kept so the declared floors survive if a
dependency reintroduces them.

web/package.json

@@ -3,7 +3,6 @@
   "version": "0.1.0",
   "private": true,
   "type": "module",
-  "packageManager": "pnpm@11.1.1",
   "scripts": {
     "dev": "vite dev",
     "build": "vite build",
@@ -25,5 +24,10 @@
     "tailwindcss": "^4.3.3",
     "vite": "^8.1.5",
     "vitest": "^4.1.10"
+  },
+  "overrides": {
+    "@babel/core": "^7.29.7",
+    "js-yaml": "^4.3.0",
+    "postcss": ">=8.5.16"
   }
 }