lockfile out of sync with package.json — breaks npm ci in trivy Security Scan

[cursor]

Problem

The trivy Security Scan job on main never reaches a vulnerability scan because docker build dies at:

RUN npm ci --workspace=apps/web --production --legacy-peer-deps

The lockfile integrity check fails because:

package	package.json requires	lockfile pinned
@ai-sdk/gateway	^4.0.55	4.0.23
postcss (apps/web nested)	^8.5.26	8.5.21

This has blocked Security Scan on PRs #1609, #1612, and #1621 and on main itself.

Fix

Regenerate package-lock.json with npm install --package-lock-only so the lockfile satisfies the manifests. No application code changes.

[linear-code]

GRV-466

[github-actions]

👋 Thanks for opening this issue! It has been automatically labeled for triage.