Omit registry URLs from package-lock.json

[oto-macenauer]

Problem

package-lock.json pins every package's resolved URL to https://registry.npmjs.org/.... Repos copied from this template that build against a private registry/mirror end up fetching from (or rewriting) the public registry URLs recorded in the lockfile, which complicates builds on private infrastructure.

Proposal

Add .npmrc with omit-lockfile-registry-resolved=true (npm >= 8.12) and regenerate package-lock.json so resolved fields are dropped. npm then resolves tarballs from whatever registry is configured in the environment, while integrity hashes still guarantee the same packages.

Acceptance

• .npmrc committed with omit-lockfile-registry-resolved=true
• package-lock.json contains no resolved entries
• npm ci still works