Fix dependency vulnerabilities

[madebydia]

Summary

• remove unused ESLint tooling and config to reduce dependency surface
• pin remaining runtime/build dependencies to exact versions
• regenerate package-lock with 38 locked packages instead of 201
• add .npmrc with ignore-scripts=true
• add Node 20/22 build CI using npm ci --ignore-scripts

Verification

• queried OSV for the regenerated lockfile: 0 reported vulnerabilities
• checked direct dependency deprecation status: none reported
• checked package.json/package-lock direct dependency consistency
• checked lockfile install-script metadata

Note: local npm is intentionally unavailable on this Mac, so build verification is delegated to the new GitHub Actions workflow.