Switch from npm to pnpm

[lehni]

Switch the development tooling of next from npm to pnpm (from #198, was #136):

• pnpm-lock.yaml, converted from package-lock.json with pnpm import, so it has the same resolved versions, and "packageManager": "pnpm@12.9.0".
• pnpm-workspace.yaml allows the build script of sqlite3. It also sets esbuild to false, because pnpm 12 fails the install for unapproved build scripts, and esbuild's script only checks its binary, which comes from an optional dependency anyway. pnpm 12 calls this setting allowBuilds, not onlyBuiltDependencies.
• tedious is ^20.3.0, locked to 20.3.6: pnpm only installs packages older than a day by default (minimumReleaseAge), and 20.3.7 was younger than that.
• peggy 5.1.0 is a devDependency, so build:parsers no longer needs npx.
• CI and the docs workflow run pnpm/action-setup@v6 and pnpm install --frozen-lockfile.
• contributing.md, the docker-compose comments and the test session's hint use pnpm. The user-facing install docs and the standalone examples keep npm install.

pnpm pack and npm pack produce the same files. lib/ and typings/ are identical, and package.json only differs in the changed scripts and devDependencies, plus pnpm moving scripts to the end. Locally the full suite passes (5916 tests, lint, typings), and so do the parser check, TypeScript 5.1 and the docs build.