chore: add lockfile for reproducible CI

[chrischanwenhui]

Summary

• Adds package-lock.json so GitHub Actions can run npm ci reliably.
• Validated the app in Codespaces using Node 20.

Testing

• npm install ✅
• npm run lint ✅
• npm run test ✅
• npm run build ✅

Notes

• Codespace initially used Node 16, which caused Vite/Vitest failures.
• Switching to Node 20 resolved the issue.