build: move from pnpm to npm

Replace pnpm-lock.yaml with package-lock.json. The security overrides move to
package.json#overrides with their range operators intact, so advisory floors
stay floors. allowBuilds becomes package.json#allowScripts where the listed
package is actually in the tree.

package.json

@@ -3,7 +3,6 @@
   "description": "A simple Sokoban game built with Svelte 5 and Vite",
   "version": "1.0.0",
   "type": "module",
-  "packageManager": "pnpm@11.1.1",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/tiennm99/sokoban.git"
@@ -25,5 +24,9 @@
     "svelte": "^5.56.2",
     "vite": "^8.0.16",
     "vite-plugin-pwa": "^1.2.0"
+  },
+  "overrides": {
+    "serialize-javascript": ">=7.0.5",
+    "fast-uri": ">=3.1.2"
   }
 }