Improve security defaults for `vp install` and other commands when using `npm`

### Description

It'd be nice if something could be done in vite-plus specifically to ensure secure defaults if a user is using npm.

See https://nesbitt.io/2026/03/31/npms-defaults-are-bad.html for examples.

### Suggested solution

For safety reasons, we should probably force `vp install` (when not passed a specific package to add) to map to `npm ci`, or at least maybe `npm install --prefer-offline`?

### Alternative

_No response_

### Additional context

It may also be a good idea to have `vp env doctor` point the user to various more-secure options as well, for example using min-release-age if not set, blocking scripts from running on-package-install (`--ignore-scripts`), and so on.

### Validations

- [x] Read the [Contributing Guidelines](https://github.com/voidzero-dev/vite-plus/blob/main/CONTRIBUTING.md).
- [x] Confirm this request is for Vite+ itself and not for Vite, Vitest, tsdown, Rolldown, or Oxc.
- [x] Check that there isn't already an issue requesting the same feature.