build: move from pnpm to npm

Replace pnpm-lock.yaml with package-lock.json. pnpm-workspace.yaml's
allowBuilds becomes package.json#allowScripts, which npm 11 gates the same way,
listing only the packages actually present in the tree.

README.md

@@ -53,7 +53,7 @@ chunks on first read. See [`docs/canvas-resize-procedure.md`](docs/canvas-resize
 ```bash
 git clone <repo-url>
 cd rplace
-pnpm install
+npm install
 ```
 
 No external storage to configure. The canvas and rate-limit state live inside
@@ -63,17 +63,17 @@ the Durable Object.
 
 ```bash
 # Run worker locally (serves API + static frontend)
-pnpm dev
+npm run dev
 
 # Or split frontend + worker
-pnpm dev:client   # Vite dev server on :5173 (proxies /api to :8787)
-pnpm dev          # Wrangler dev server on :8787
+npm run dev:client  # Vite dev server on :5173 (proxies /api to :8787)
+npm run dev         # Wrangler dev server on :8787
 ```
 
 ### Deploy
 
 ```bash
-pnpm deploy   # Builds frontend + deploys worker to Cloudflare
+npm run deploy  # Builds frontend + deploys worker to Cloudflare
 ```
 
 ## Project Structure

package.json

@@ -2,7 +2,6 @@
   "name": "rplace",
   "private": true,
   "type": "module",
-  "packageManager": "pnpm@11.1.1",
   "scripts": {
     "dev": "wrangler dev",
     "dev:client": "vite dev",
@@ -23,5 +22,9 @@
     "vitest": "^4.1.10",
     "wrangler": "^4.112.0",
     "ws": "^8.21.0"
+  },
+  "allowScripts": {
+    "esbuild": true,
+    "workerd": true
   }
 }

pnpm-workspace.yaml

@@ -1,4 +0,0 @@
-allowBuilds:
-  esbuild: true
-  sharp: true
-  workerd: true