fix(web): approve the two dependencies that need install scripts

pnpm 10 refuses to silently run a dependency's build script. Locally
that is a warning; on the runner it is ERR_PNPM_IGNORED_BUILDS and the
job fails, so build-web broke on run 13 while everything passed here.

@swc/core and esbuild both fetch a platform-native binary at install
time and do not work without it, so they are allowlisted explicitly via
pnpm.onlyBuiltDependencies. Everything else in the tree stays denied,
which is the point of the feature -- an install script is arbitrary code
from a transitive dependency.

Also sets strict-dep-builds in web/.npmrc so a skipped build script is
an error here too. Same reasoning as the release-age policy added
earlier: a local install that passes where the runner fails is a
difference only discoverable by pushing, and that is a slow way to find
out.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XZG2i4AmfSqE97EJGBVb64

web/.npmrc

@@ -5,3 +5,8 @@
 #
 # 1440 minutes = 24h, the runner's cutoff.
 minimum-release-age=1440
+
+# Treat a dependency whose build script was skipped as an error, not a warning.
+# The runner does; without this the local install passes, the runner fails, and
+# the difference is only discoverable by pushing.
+strict-dep-builds=true

web/package.json

@@ -32,5 +32,11 @@
     "typescript": "^5.9.3",
     "typescript-eslint": "^8.46.2",
     "vite": "^7.2.2"
+  },
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "@swc/core",
+      "esbuild"
+    ]
   }
 }