Stop gitignoring the lockfile and commit a freshly regenerated one so CI and Docker builds install a pinned dependency tree instead of re-resolving `^` ranges on every run. Fresh resolution matches the versions already building (no version changes). Document the convention in CLAUDE.md. Enables `npm ci` as a follow-up.
