chore: gitignore pnpm-lock.yaml, keep pnpm-workspace.yaml tracked

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.github/workflows/deploy-qas.yml

@@ -6,7 +6,6 @@ on:
     paths:
       - 'apps/api/**'
       - 'docker-compose.yml'
-      - 'pnpm-lock.yaml'
       - 'pnpm-workspace.yaml'
   workflow_dispatch: {}
 

.github/workflows/deploy.yml

@@ -6,7 +6,6 @@ on:
     paths:
       - 'apps/api/**'
       - 'docker-compose.yml'
-      - 'pnpm-lock.yaml'
       - 'pnpm-workspace.yaml'
   workflow_dispatch: {}
 

.gitignore

@@ -1,5 +1,6 @@
 # ── Dependencies ──────────────────────────────────────────────────────────────
 node_modules/
+pnpm-lock.yaml
 
 # ── Environment / Secrets ─────────────────────────────────────────────────────
 .env

apps/api/Dockerfile

@@ -16,11 +16,13 @@ WORKDIR /app
 
 # Workspace manifests first (cache-friendly), then a filtered install —
 # pnpm needs every workspace package's manifest present to resolve the
-# graph even though only apps/api's deps get installed here.
-COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+# graph even though only apps/api's deps get installed here. pnpm-lock.yaml
+# is gitignored (not committed), so this resolves fresh on every build
+# rather than installing from a frozen lockfile.
+COPY package.json pnpm-workspace.yaml ./
 COPY apps/api/package.json ./apps/api/package.json
 COPY apps/web/package.json ./apps/web/package.json
-RUN pnpm install --frozen-lockfile --filter api...
+RUN pnpm install --filter api...
 
 COPY apps/api ./apps/api