fix: make the lockfile installable outside a China mirror

pnpm-lock.yaml had 383 tarball URLs pointing at registry.npmmirror.com,
picked up from the registry configured on the machine that generated it.
GitHub's runners cannot reach that host, so every CI job died in
`pnpm install` with a wall of 502s — and so would any contributor outside
that network.

Regenerating against the public registry produces a lockfile with no
registry URLs at all: pnpm's v9 format records integrity hashes and leaves
the source to configuration, which is what makes it portable.

A project .npmrc pins the public registry so a global mirror cannot leak
back in. Using a mirror locally no longer requires touching the lockfile:

  npm_config_registry=https://your-mirror/ pnpm install --no-frozen-lockfile

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: Garfield-yin

.npmrc

@@ -0,0 +1,6 @@
+# Pin the public registry so the lockfile resolves for everyone, including CI.
+# A mirror configured globally would otherwise bake its own URLs into
+# pnpm-lock.yaml and break installs outside that network.
+# To use a mirror locally without touching the lockfile:
+#   npm_config_registry=https://your-mirror/ pnpm install --no-frozen-lockfile
+registry=https://registry.npmjs.org/