chore: remove vestigial apps/web/package-lock.json

.changeset/chore-remove-npm-lockfile.md

@@ -0,0 +1,15 @@
+---
+'@deessejs/errors': patch
+---
+
+chore: remove vestigial `apps/web/package-lock.json` and ignore npm/yarn lockfiles
+
+The repo is a pnpm monorepo (`packageManager: pnpm@10.34.5` in the root `package.json`); no CI step or build path reads `apps/web/package-lock.json`. It was a stale artifact from the initial commit and still pinned transitive `postcss@8.4.31` (vulnerable) and old `next@16.2.6` / `fumadocs-*@16.9.1` — keeping it around is a permanent source of Dependabot noise that no longer matches the actual install graph.
+
+This PR:
+
+- deletes `apps/web/package-lock.json`
+- adds `package-lock.json` and `yarn.lock` to the root `.gitignore` so contributors running `npm install` locally don't re-introduce the file
+- adds `package-lock.json` to `apps/web/.gitignore` as defense-in-depth
+
+No dependency changes; the `patch` bump exists only to satisfy the staging changeset requirement.

.gitignore

@@ -37,6 +37,10 @@ temp/
 # pnpm
 .pnpm-store/
 
+# npm/yarn are not used in this pnpm monorepo; ignore their lockfiles
+package-lock.json
+yarn.lock
+
 # Turbo remote cache
 .turbo/
 

apps/web/.gitignore

@@ -19,6 +19,7 @@
 npm-debug.log*
 yarn-debug.log*
 yarn-error.log*
+package-lock.json
 
 # others
 .env*.local