refactor(ci): inline pnpm build-script approval into package.json

Addresses review feedback on #413: for a single-package project,
pnpm-workspace.yaml is unnecessary and its 'packages: [.]' declaration
turns the web/ directory into a pnpm workspace root, which is a
semantic side effect we don't want.

Move onlyBuiltDependencies under the 'pnpm' field in package.json
(pnpm 10 still reads it there) and drop the workspace file from the
Dockerfile COPY list. Verified locally with docker buildx: pnpm 10.33
runs esbuild postinstall and the build succeeds.

web/Dockerfile

@@ -1,7 +1,7 @@
 FROM node:22-alpine AS build
 RUN corepack enable
 WORKDIR /app
-COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+COPY package.json pnpm-lock.yaml ./
 RUN pnpm install --frozen-lockfile
 COPY . .
 RUN pnpm build

web/package.json

@@ -4,6 +4,11 @@
   "version": "0.1.0",
   "type": "module",
   "packageManager": "pnpm@10.33.0",
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "esbuild"
+    ]
+  },
   "scripts": {
     "install:ci": "pnpm install --frozen-lockfile",
     "dev": "vite",

web/pnpm-workspace.yaml

@@ -1,5 +0,0 @@
-packages:
-  - '.'
-
-onlyBuiltDependencies:
-  - esbuild