build: use npm as the only package manager

[ronjalh]

Summary

The repository had both package-lock.json and pnpm-lock.yaml, so dependency versions could differ between developers, and not everyone can run pnpm locally. npm is now the only package manager.

• Removes pnpm-lock.yaml and the pnpm entries in .gitignore and .prettierignore.
• Adds package-lock.json to .prettierignore. It is generated by npm, so Prettier should never rewrite it.
• The README uses npm ci and npm run ..., and says that the project uses npm.
• Declares the Node version in engines in package.json.

package-lock.json is not part of the diff because it is already tracked on main. This PR does not change it.

Testing

From a clean checkout (node_modules removed): npm ci, npm run lint, npm run build and npm test all pass.

Closes #30

🤖 Generated with Claude Code

[anettkva]

Nice, this is a clean switch! Two questions before we merge:

1. Should we add package-lock.json? The PR deletes pnpm-lock.yaml but I can't see npm's lock file in the changes, and the README now uses npm ci, which needs it. Could you run npm install and commit the generated package-lock.json, or is it left out on purpose?
2. Should package-lock.json go in .prettierignore? The PR removes pnpm-lock.yaml from it. Since the npm lock file is also generated, would it make sense to ignore it too, so Prettier never touches it?

[ronjalh]

1. package-lock.json is already tracked on main (added in chore: setup vitest), so it does not show up in the diff. The PR only deletes pnpm-lock.yaml. npm ci works from a clean checkout; I ran npm ci, lint, build and tests to confirm.
2. Good point. Prettier does not ignore lock files by default, so I added package-lock.json to .prettierignore in d97887b.