build: move from pnpm to npm

Replace pnpm-lock.yaml with package-lock.json. The security overrides move to
package.json#overrides with their range operators intact, so advisory floors
stay floors. allowBuilds becomes package.json#allowScripts where the listed
package is actually in the tree.

.github/workflows/deploy.yml

@@ -22,20 +22,18 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
       
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v6
 
       - name: Setup Node
         uses: actions/setup-node@v6
         with:
           node-version: '24'
-          cache: 'pnpm'
+          cache: 'npm'
 
       - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+        run: npm ci
 
       - name: Build
-        run: pnpm build
+        run: npm run build
       
       - name: Setup Pages
         uses: actions/configure-pages@v6