Fix CI: track package-lock.json files for npm ci

Both CI jobs failed because package-lock.json was in .gitignore.
npm ci requires lock files to exist. Now tracking both root and
web/ lock files.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: mattglory

.gitignore

@@ -9,7 +9,7 @@ yarn-debug.log*
 yarn-error.log*
 .npm
 .eslintcache
-package-lock.json
+# package-lock.json is tracked — required for CI (npm ci)
 
 # ============================================
 # Clarinet