build: move from pnpm to npm

Replace pnpm-lock.yaml with package-lock.json. pnpm-workspace.yaml's
allowBuilds becomes package.json#allowScripts, which npm 11 gates the same way,
listing only the packages actually present in the tree.

package.json

@@ -2,7 +2,6 @@
   "name": "rplace",
   "private": true,
   "type": "module",
-  "packageManager": "pnpm@11.1.1",
   "scripts": {
     "dev": "wrangler dev",
     "dev:client": "vite dev",
@@ -23,5 +22,9 @@
     "vitest": "^4.1.10",
     "wrangler": "^4.112.0",
     "ws": "^8.21.0"
+  },
+  "allowScripts": {
+    "esbuild": true,
+    "workerd": true
   }
 }