build: move from pnpm to npm

Replace pnpm-lock.yaml with package-lock.json. allowBuilds for esbuild becomes
package.json#allowScripts. The Dockerfile installs with npm ci --omit=dev and
no longer prepares pnpm through corepack; .npmrc keeps engine-strict, which npm
honours natively.

minimumReleaseAgeExclude is dropped rather than translated: pnpm's
minimumReleaseAge was never set, so the 30-entry exclusion list had nothing to
exclude from. Direct dependency versions resolve identically to the pnpm
lockfile.

renderer/docs/deployment.md

@@ -41,7 +41,7 @@ the service is CPU-bound or concurrency-limited.
 
 Local non-Docker render smoke requires Chrome Headless Shell shared libraries,
 including `libnspr4` and `libnss3`. Prefer Docker for consistent verification.
-The Docker image runs `pnpm browser:ensure` during build so production requests
+The Docker image runs `npm run browser:ensure` during build so production requests
 do not need to download Chrome Headless Shell on first render.
 
 `RENDER_TIMEOUT_MS` is a total render timeout. Values below `7000` are raised to

renderer/docs/render-benchmarks.md

@@ -3,7 +3,7 @@
 Fill this after running:
 
 ```sh
-pnpm render:fixtures
+npm run render:fixtures
 ```
 
 | Fixture | Size | FPS | Duration | Bytes | Render Time | Notes |