build: switch from npm to pnpm

- Replace package-lock.json with pnpm-lock.yaml
- Add packageManager: pnpm@10.33.0
- Allowlist postinstall scripts for esbuild, sharp, vue-demi, electron,
  electron-winstaller via pnpm.onlyBuiltDependencies
- Pin nostr-tools to 2.15.0 (was ^2.10.4 resolving to 2.15.0 via npm).
  A fresh pnpm resolve drifted to 2.23.5, which the regtest nostrrelay
  extension can't parse; upgrade deferred to a follow-up issue covering
  the matching server-side fix.

package.json

@@ -59,7 +59,7 @@
     "light-bolt11-decoder": "^3.2.0",
     "lucide-vue-next": "^0.474.0",
     "ngeohash": "^0.6.3",
-    "nostr-tools": "^2.10.4",
+    "nostr-tools": "2.15.0",
     "pinia": "^2.3.1",
     "qr-scanner": "^1.4.2",
     "qrcode": "^1.5.4",
@@ -138,5 +138,15 @@
     "directories": {
       "output": "dist_electron"
     }
+  },
+  "packageManager": "pnpm@10.33.0",
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "electron",
+      "electron-winstaller",
+      "esbuild",
+      "sharp",
+      "vue-demi"
+    ]
   }
 }