fix: swap bun install for npm ci to fix integrity check failures

Known Bun bug (oven-sh/bun#1590, #26879, #18864) causes
IntegrityCheckFailed during tarball extraction in Docker/CI.
This is a 3+ year old issue with no fix in sight.

Changes:
- Generate package-lock.json via npm install --package-lock-only
- Dockerfile: add nodejs npm to all stages, replace bun install
  with npm ci --legacy-peer-deps (peer dep conflict exists for
  eslint@8 with eslint-config-next@16)
- Keep bun as runtime (bun test, bun run build, bun run start)
- pr.yml: npm ci, npx prisma generate, npx playwright
- release.yml: node scripts, npm test
- build-ci-images.yml: add package-lock.json trigger path

.gitea/workflows/build-ci-images.yml

@@ -8,6 +8,7 @@ on:
       - "Dockerfile.ci-base"
       - "package.json"
       - "bun.lock"
+      - "package-lock.json"
       - ".gitea/workflows/build-ci-images.yml"
   schedule:
     # Weekly rebuild to get latest Playwright/Bun versions