chore(build): canonicalize on npm, add phantom-import guardrail

Two changes to prevent a repeat of the 14-hour production outage where
Vercel's pnpm build couldn't resolve 'advanced-cropper' while local
npm builds worked fine.

1. Delete pnpm-lock.yaml. Both lockfiles were tracked, and Vercel was
   picking pnpm on the tie-break. Everything else about the repo
   (package.json scripts, CLAUDE.md, README.md, docs/SETUP.md,
   docs/CONTRIBUTING.md, GitHub Actions CI) uses npm, so pnpm was the
   outlier. Keeping package-lock.json makes npm the single source of
   truth and eliminates drift between the two lockfiles.

2. Add the import/no-extraneous-dependencies ESLint rule (plugin is
   already in devDependencies). This catches any `import from 'foo'`
   where 'foo' is a transitive dependency instead of an explicit one
   — the exact failure mode that broke production. Verified locally:
   temporarily removing advanced-cropper from package.json triggers
   the expected error at CustomStencil.tsx:5.

   Test files, e2e specs, scripts, and config files are allowed to
   import from devDependencies.

Author: kevinkiklee

eslint.config.js

@@ -3,6 +3,7 @@ import globals from 'globals'
 import reactHooks from 'eslint-plugin-react-hooks'
 import jsxA11y from 'eslint-plugin-jsx-a11y'
 import nextPlugin from '@next/eslint-plugin-next'
+import importPlugin from 'eslint-plugin-import'
 import tseslint from 'typescript-eslint'
 
 export default tseslint.config(
@@ -18,6 +19,7 @@ export default tseslint.config(
       'react-hooks': reactHooks,
       'jsx-a11y': jsxA11y,
       '@next/next': nextPlugin,
+      import: importPlugin,
     },
     rules: {
       ...reactHooks.configs.recommended.rules,
@@ -31,6 +33,29 @@ export default tseslint.config(
         argsIgnorePattern: '^_',
         varsIgnorePattern: '^_',
       }],
+      // Guardrail against phantom imports: catch any `import from 'foo'` where
+      // 'foo' is only a transitive dep. This exact failure (advanced-cropper
+      // imported but only reachable via react-advanced-cropper) broke the
+      // Vercel production build for ~14h because pnpm's strict isolated
+      // layout doesn't expose transitive deps the way npm's flat hoisting
+      // does. Test files, configs, and scripts are allowed to use
+      // devDependencies.
+      'import/no-extraneous-dependencies': ['error', {
+        devDependencies: [
+          '**/*.test.{ts,tsx}',
+          '**/*.spec.{ts,tsx}',
+          'src/e2e/**',
+          'scripts/**',
+          'test-setup*.ts',
+          'vitest.config.ts',
+          'playwright.config.ts',
+          'eslint.config.js',
+          'next.config.ts',
+          'sentry.*.config.ts',
+        ],
+        optionalDependencies: false,
+        peerDependencies: false,
+      }],
     },
   },
 )