Commit a lockfile (package-lock.json) for reproducible Mix asset builds

Problem

The backend module (and other Mix packages) declare their npm dependencies with caret ranges (^) in package.json, and there is no committed lockfile (package-lock.json). As a result, php artisan mix:install / npm install resolves each dependency to the newest version within its range, which drifts over time away from the versions the committed compiled assets (modules/backend/assets/ui/js/build/vendor.js, modules/backend/formwidgets/*/assets/js/dist/*.js, etc.) were originally built with.

When anyone subsequently runs php artisan mix:compile, the regenerated assets differ from what's committed — not because of any source change, but purely due to dependency version drift. This produces noisy, unrelated diffs in the compiled bundles and makes asset builds non-reproducible.

Concrete example (surfaced in #1491)

While adding a SortableJS bundle in #1491, running mix:compile -p module-backend regenerated vendor.js, colorpicker.js, and iconpicker.js with no source changes, purely because the local install had drifted:

Only vue's build version is recoverable (it's embedded in vendor.js); the others aren't, so the canonical versions can't be reconstructed after the fact — which is exactly why a lockfile is needed.

Proposed fix

• Commit a package-lock.json (at the npm-workspaces root) generated in the canonical build environment.
• Use npm ci rather than npm install for CI / asset compilation so installs are deterministic.
• Optionally rebuild & commit the affected bundles once so the lockfile and committed assets are in sync going forward.

Notes

• sortablejs was pinned to an exact version in #1491 as a stopgap for the dependency that PR introduced, but that does not address the pre-existing drift of the other dependencies.
• This is a repo-wide build-reproducibility concern, intentionally kept out of #1491 to keep that PR focused.

🤖 Generated with Claude Code

Start at the npm-workspaces root and inspect the package.json files, the existing asset build commands, and the committed bundles under modules/backend/assets/ui/js/build/ and modules/backend/formwidgets/*/assets/js/dist/. Generate the canonical package-lock.json, update CI or asset compilation to use npm ci, and verify whether the affected bundles need rebuilding so installs and committed assets remain reproducible.