package-lock.json was gitignored, so CI checkouts didn't have it and npm ci failed. Removing from .gitignore so it's tracked and CI can install dependencies deterministically.
