build: move web/ from pnpm to npm

Replace pnpm-lock.yaml with package-lock.json and drop pnpm-workspace.yaml.
The three security overrides move to package.json#overrides, which npm reads
natively; allowBuilds for esbuild is unnecessary because npm runs dependency
build scripts by default.

android/build:web drove the web build through corepack pnpm, so it would have
broken once web/pnpm-lock.yaml was gone. It now uses npm --prefix.

Fresh resolution picks up patched versions the old lockfile had pinned below,
so npm audit reports no advisories where pnpm audit reported eight.

.github/actions/setup-web/action.yml

@@ -1,24 +1,18 @@
 name: Set up web toolchain
 description: >
-  Installs pnpm and Node, then restores web/ dependencies from the lockfile.
+  Installs Node, then restores web/ dependencies from the lockfile.
   Node stays in lockstep with .github/actions/setup-android so the SvelteKit
   app is tested and bundled into the APK on the same runtime.
 
 runs:
   using: composite
   steps:
-    # Must precede setup-node: `cache: pnpm` needs the pnpm binary to
-    # resolve the store path.
-    - uses: pnpm/action-setup@v6
-      with:
-        package_json_file: web/package.json
-
     - uses: actions/setup-node@v7
       with:
         node-version: '24'
-        cache: pnpm
-        cache-dependency-path: web/pnpm-lock.yaml
+        cache: npm
+        cache-dependency-path: web/package-lock.json
 
-    - run: pnpm install --frozen-lockfile
+    - run: npm ci
       shell: bash
       working-directory: web

.github/workflows/android-release.yml

@@ -28,12 +28,12 @@ jobs:
 
       # ci.yml does not run on tags, so this is the only gate before signing.
       - name: Test web
-        run: pnpm test
+        run: npm test
         working-directory: web
 
       # Base "" — the APK loads the bundle from the domain root.
       - name: Build web
-        run: pnpm build
+        run: npm run build
         working-directory: web
 
       - uses: ./.github/actions/setup-android

.github/workflows/ci.yml

@@ -44,7 +44,7 @@ jobs:
         with:
           persist-credentials: false
       - uses: ./.github/actions/setup-web
-      - run: pnpm test
+      - run: npm test
         working-directory: web
 
   build:
@@ -68,7 +68,7 @@ jobs:
         with:
           persist-credentials: false
       - uses: ./.github/actions/setup-web
-      - run: pnpm ${{ matrix.script }}
+      - run: npm run ${{ matrix.script }}
         working-directory: web
       - uses: actions/upload-artifact@v7
         with: