fix: sync package lock with manifest

[westkite1201]

Summary

• Sync package-lock.json with the current package.json dependency manifest.
• Update the lockfile entry for @circle-fin/developer-controlled-wallets from the stale 8.4.1 graph to 10.6.0, which satisfies the existing ^10.0.1 package.json range.
• Remove stale lockfile root dependencies that are no longer present in package.json.

Why

package.json already depends on @circle-fin/developer-controlled-wallets@^10.0.1, but package-lock.json still listed the root dependency as ^8.4.1 and retained removed dependencies. A clean npm install fails during dependency resolution because the manifest and lockfile disagree.

Verification

• npm install --package-lock-only --ignore-scripts
• npm ci --package-lock-only --ignore-scripts
• git diff --check

Duplicate check

Checked existing PRs for developer-controlled-wallets, package-lock, npm install, and ERESOLVE. The duplicate gate surfaced #34, but that PR is the OpenZeppelin webhook signature fix and does not modify package-lock.json, so this lockfile sync is separate.