build: move web/ from pnpm to npm

Replace pnpm-lock.yaml with package-lock.json and drop pnpm-workspace.yaml.
The three security overrides move to package.json#overrides, which npm reads
natively; allowBuilds for esbuild is unnecessary because npm runs dependency
build scripts by default.

android/build:web drove the web build through corepack pnpm, so it would have
broken once web/pnpm-lock.yaml was gone. It now uses npm --prefix.

Fresh resolution picks up patched versions the old lockfile had pinned below,
so npm audit reports no advisories where pnpm audit reported eight.

android/package.json

@@ -4,7 +4,7 @@
   "private": true,
   "description": "Capacitor wrapper that bundles the web/ app into a fully-offline Android APK.",
   "scripts": {
-    "build:web": "corepack pnpm@11.1.1 --dir ../web install --frozen-lockfile && corepack pnpm@11.1.1 --dir ../web run build",
+    "build:web": "npm --prefix ../web ci && npm --prefix ../web run build",
     "sync": "cap sync android",
     "build": "npm run build:web && npm run sync",
     "open": "cap open android",