fix(ui): pin pnpm 10.16.1 + onlyBuiltDependencies allowlist

Docker build was failing on `pnpm install` because corepack pulled the
latest pnpm (v11.x) which exits non-zero when build scripts (esbuild)
are present without explicit approval. Pin to v10.16.1 (stable, ships
the same `onlyBuiltDependencies` shape) and declare the esbuild build
script in package.json so future v11+ upgrades stay non-interactive.

Also swap `2>/dev/null || pnpm install` for `|| pnpm install --no-frozen-lockfile`
so we don't swallow real diagnostics — fall back to a controlled lockfile
update only when --frozen-lockfile fails.

Dockerfile

@@ -1,9 +1,15 @@
 # Stage 1: Build embedded admin UI
 FROM node:22-alpine AS ui
-RUN corepack enable && corepack prepare pnpm@latest --activate
+# Pin pnpm to a known-good version so corepack doesn't pull a tagged-but-unsigned
+# release. v10.x supports `onlyBuiltDependencies` in package.json and does not
+# fail the install step on ignored build scripts (newer v11 returns non-zero
+# unless explicitly approved, even in non-interactive Docker builds).
+RUN corepack enable && corepack prepare [email protected] --activate
 WORKDIR /ui
 COPY ui/package.json ui/pnpm-lock.yaml* ./
-RUN pnpm install --frozen-lockfile 2>/dev/null || pnpm install
+# `--frozen-lockfile` first so verifiable builds win; fall back to a
+# lockfile-updating install if the lock is missing.
+RUN pnpm install --frozen-lockfile || pnpm install --no-frozen-lockfile
 COPY ui/ .
 RUN pnpm build
 

ui/package.json

@@ -19,5 +19,10 @@
     "@vitejs/plugin-react": "^4.3.4",
     "typescript": "^5.7.0",
     "vite": "^6.0.0"
+  },
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "esbuild"
+    ]
   }
 }