Sync package-lock.json with package.json (vite mismatch broke npm ci)

Tambi — deploy to Hugging Face Spaces