fix(deps): sync web and vis lockfiles so npm ci succeeds in build

The react 19.2.7 / vite 8 bump left both lockfiles missing the nested
@emnapi/* transitive deps of the wasm32-wasi bindings (oxc-parser,
oxc-resolver, rolldown), so `npm ci` failed with EUSAGE ("package.json
and package-lock.json are not in sync") and broke `make build-web` /
build-vis in the PyInstaller onefile build jobs.

Regenerate both lockfiles with `npm install --package-lock-only`; the
only changes are the missing @emnapi core/runtime/wasi-threads entries.
Verified `npm ci` now succeeds in both web/ and vis/.

Author: elkaix