build: move web/ from pnpm to npm

Replace pnpm-lock.yaml with package-lock.json and drop pnpm-workspace.yaml.
The three security overrides move to package.json#overrides, which npm reads
natively; allowBuilds for esbuild is unnecessary because npm runs dependency
build scripts by default.

android/build:web drove the web build through corepack pnpm, so it would have
broken once web/pnpm-lock.yaml was gone. It now uses npm --prefix.

Fresh resolution picks up patched versions the old lockfile had pinned below,
so npm audit reports no advisories where pnpm audit reported eight.

.github/workflows/android-release.yml

@@ -28,12 +28,12 @@ jobs:
 
       # ci.yml does not run on tags, so this is the only gate before signing.
       - name: Test web
-        run: pnpm test
+        run: npm test
         working-directory: web
 
       # Base "" — the APK loads the bundle from the domain root.
       - name: Build web
-        run: pnpm build
+        run: npm run build
         working-directory: web
 
       - uses: ./.github/actions/setup-android

.github/workflows/ci.yml

@@ -44,7 +44,7 @@ jobs:
         with:
           persist-credentials: false
       - uses: ./.github/actions/setup-web
-      - run: pnpm test
+      - run: npm test
         working-directory: web
 
   build:
@@ -68,7 +68,7 @@ jobs:
         with:
           persist-credentials: false
       - uses: ./.github/actions/setup-web
-      - run: pnpm ${{ matrix.script }}
+      - run: npm run ${{ matrix.script }}
         working-directory: web
       - uses: actions/upload-artifact@v7
         with: