ci: use npm ci now that package-lock.json is tracked

[petergstfsn]

What changed

• Drop the stale comment in the web job claiming package-lock.json is intentionally untracked and that npm ci is not usable.
• Switch npm install to npm ci so the job installs from the lockfile.

The comment no longer matches the repo: package-lock.json is tracked at the root (152 KB) and is not covered by .gitignore. Because of the stale comment the web job was doing an unpinned npm install resolve on every run, while cloudflare.yml (both verify and upload) already uses npm ci. The two workflows disagreed about a basic fact of the repo; this aligns them and makes the web job's installs reproducible.

Verification

Run locally on the merge commit of #11 with Node 22.22.2 / npm 10.9.7, reproducing the web job step for step:

• npm ci — exit 0, 210 packages installed, lockfile in sync with package.json
• npx tsc -b in apps/web — exit 0
• npm run test:web — 11 test files, 33 tests, all passed
• npm run build:web — exit 0, Vite build output produced

YAML re-parsed after the edit; the web job's steps resolve to checkout → setup-node → npm ci → npx tsc -b → npm run test:web → npm run build:web.

Review flags

• CI configuration only; one line changed and one comment removed in .github/workflows/ci.yml.
• No change to the api job, to cloudflare.yml, to dependencies, or to the lockfile.
• No deployment behavior is affected — this workflow has no deploy step and no secrets.

---

Generated by Claude Code