Frontend has both npm and pnpm lockfiles, risking dependency version drift

[IzBrain67]

Summary

gui/workflow_frontend/ contains both package-lock.json and pnpm-lock.yaml. Local development and the Docker build use different package managers:

• Local development: pnpm install / pnpm run dev (uses pnpm-lock.yaml)
• Docker build: npm ci (uses package-lock.json)

Problem

When package.json is updated, both lockfiles must be updated together — otherwise local and production (Docker) environments may resolve different dependency versions.

The two lockfiles are already out of sync in terms of last-modified time:

• package-lock.json: 2026-05-19
• pnpm-lock.yaml: 2026-05-13

This is a setup that can easily produce "works locally but breaks in the Docker build" (or vice versa) bugs.

Background

This came up while debugging a docker compose build failure. The direct cause of that failure was that the local pnpm-style node_modules was being copied into the container by COPY . /frontend and conflicting with the npm-style node_modules created by npm ci (fixed by adding a .dockerignore). The lockfile duplication is not what caused that failure, but it is a related latent risk worth tracking separately.

Possible resolutions

One of:

1. Standardize on pnpm: switch the Dockerfile to pnpm install --frozen-lockfile and remove package-lock.json.
2. Standardize on npm: switch local development to npm and remove pnpm-lock.yaml.
3. Keep both + add a CI check: keep both lockfiles and verify in CI that they stay in sync whenever package.json changes.