build: migrate frontend tooling to pnpm (v3) (#678)

* build: migrate frontend tooling to pnpm (v3)

Rebuilds the stale #673 on current 3.x so it doesn't revert #657's test
split, the Node-24 action bumps, or composer-install@4.0.0.

- package.json: packageManager pnpm@11.6.0; drop dead 'resolutions'
- pnpm-workspace.yaml: nodeLinker hoisted, allowBuilds vue-demi,
  overrides brace-expansion (replaces resolutions)
- pnpm-lock.yaml generated via 'pnpm import' from yarn.lock (keeps the
  resolved versions, incl. vite 8.0.3 / rolldown rc.12); yarn.lock removed
- docker.yaml + release.yaml: pnpm/action-setup@v6 + cache pnpm + pnpm
  install/build (action versions and the #657 split left intact; check.yaml
  needs no change — its test job is PHP-only after #657)
- 3 Dockerfiles: node:24 + corepack + pnpm install --frozen-lockfile && pnpm build
- Makefile, composer 'dev' script, CLAUDE.md, .gitignore -> pnpm

* fix(deps): pin vite to 8.0.5 (security)

Now that 3.x is the default branch, Dependabot flags vite <8.0.5. Pin to
8.0.5 (the patched version), which keeps rolldown 1.0.0-rc.12 — still
below 8.0.15 where the broken rolldown 1.0.3 (the init_runtime_dom_esm_bundler
chunk regression) starts, so the build stays clean. Mirrors v2's #674.

docker/development/Dockerfile

@@ -1,7 +1,7 @@
 FROM --platform=$BUILDPLATFORM node:24 AS static_builder
     WORKDIR /var/www/html
     COPY . /var/www/html
-    RUN yarn && yarn build
+    RUN corepack enable && pnpm install --frozen-lockfile && pnpm build
 
 FROM serversideup/php:8.4-fpm-alpine AS base
     USER root