chore: migrate from npm to pnpm

[loudsheep]

• Replace package-lock.json with pnpm-lock.yaml
• Add .npmrc with shamefully-hoist=true for NestJS compatibility
• Add packageManager field and pnpm.onlyBuiltDependencies to package.json
• Update CI workflow to use pnpm/action-setup and pnpm commands

[Copilot]

Pull request overview

This PR migrates the repository’s Node.js dependency management and CI pipeline from npm to pnpm to improve install performance and lockfile consistency across environments.

Changes:

• Add packageManager and pnpm configuration (pnpm.onlyBuiltDependencies) to package.json.
• Add .npmrc with shamefully-hoist=true to support NestJS/module resolution expectations.
• Update GitHub Actions CI workflow to install/cache dependencies with pnpm and run pnpm-based commands.

Reviewed changes

Copilot reviewed 3 out of 5 changed files in this pull request and generated 2 comments.

File	Description
package.json	Pins pnpm via packageManager and adds pnpm-specific configuration.
.npmrc	Enables shamefully-hoist for pnpm installs.
.github/workflows/ci.yml	Switches dependency install and script execution in CI from npm to pnpm.

Comments suppressed due to low confidence (2)

.github/workflows/ci.yml:52

• This uses npx prisma ... even though dependencies are installed with pnpm; npx can fall back to downloading packages and ignores pnpm's lockfile guarantees. Prefer pnpm exec prisma generate (or a pnpm run script) to ensure the Prisma CLI version comes from the lockfile.

      - name: Generate Prisma Client
        run: npx prisma generate
        if: always()

.github/workflows/ci.yml:66

• Same concern as above: npx prisma migrate deploy can bypass the pnpm lockfile if it falls back to downloading. Prefer pnpm exec prisma migrate deploy so CI always runs the Prisma CLI version installed by pnpm.

      - name: Apply Prisma migrations
        run: npx prisma migrate deploy
        if: always()

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.