chore: untrack vendor sdk node_modules, sync lockfile

The /vendor/photo-gallery-sdk/node_modules ignore rule had no effect
because the nanoid files inside it were already tracked, so `npm install`
kept surfacing them as modified. Drops them from the index; they stay on
disk and npm install regenerates them (photo-gallery-sdk is a file: dep).

Lockfile churn is from that same install: onnxruntime-web and friends
un-hoisted under @huggingface/transformers, and @types/react/csstype
moved dev -> devOptional.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.gitignore

@@ -9,6 +9,7 @@
 !.yarn/plugins
 !.yarn/releases
 !.yarn/versions
+/vendor/photo-gallery-sdk/node_modules
 
 # testing
 /coverage