Migrate api, admin, site, and create-app to pnpm

[VPS-Obi]

Switches the whole repo from npm to pnpm while preserving per-package independence — each package keeps its own lockfile and node_modules, and there is intentionally no shared pnpm workspace.

Package manager & lockfiles

• Replaced all six package-lock.json with pnpm-lock.yaml (root, api, admin, admin/server, site, create-app).
• Pinned pnpm@10.33.0 via the packageManager field in every package.json (corepack-friendly).

pnpm-specific correctness

• api: converted the npm-style top-level overrides (for @apollo/server) to pnpm.overrides + peerDependencyRules. Without this the override was silently dropped and strict peer-deps failed.
• Added pnpm.onlyBuiltDependencies where dependency build scripts are genuinely needed (pnpm 10 blocks them by default): sharp/protobufjs (api), @swc/core/@parcel/watcher (admin), esbuild/@parcel/watcher (site).
• .npmrc: strict-peer-deps → strict-peer-dependencies; min-release-age=3 (npm days) → minimum-release-age=4320 (pnpm minutes).

Scripts & tooling

• Root and package scripts, install.sh, dev-pm.config.ts, lint-staged.config.js, .husky/pre-commit, and create-app runtime helpers now use pnpm --dir <pkg> run … / pnpm exec ….

CI & deployment

• setup composite action + workflows use pnpm/action-setup@v4 and pnpm install --frozen-lockfile (strict peer-deps enforced via NPM_CONFIG_STRICT_PEER_DEPENDENCIES).
• Dockerfiles and deploy scripts enable pnpm via corepack; DigitalOcean specs use pnpm; publish workflow uses pnpm version / pnpm publish --no-git-checks.

Lint config

• Ignore pnpm-lock.yaml in prettier and eslint configs (it now matches the *.yaml lint glob, unlike the old JSON lockfile).

Docs

• Updated README.md, AGENTS.md, and create-app/README.md.

Verification

• All six pnpm install --frozen-lockfile runs pass under strict peer-deps.
• create-app builds and fully lints (eslint/knip/prettier/tsc) via the pnpm orchestration.
• Prettier passes in every package with the new ignores.
• The converted pre-commit hook ran through pnpm during commit and passed.

Not verified in this environment

• App runtime (needs Postgres/docker) and the actual DigitalOcean/Docker deploys — the conversions are the faithful pnpm equivalents but were not executed end-to-end.
• The sandbox runs Node 22 vs the project's Node 24, which only produced harmless engine warnings.

Note: scope was extended slightly beyond the four named packages to the root orchestration and admin/server, since the root scripts invoke the four packages and had to change regardless. All packages remain independent — no workspace was introduced.

🤖 Generated with Claude Code

https://claude.ai/code/session_019aLWK3cCP73rpga9K9DKMc