In an npm monorepo, only the root lockfile is authoritative. Workspace-specific
lockfiles were stale, couldn't benefit from root overrides, and were triggering
Dependabot false positives. Switching to **/package-lock.json gitignore pattern.
Also adds eslint peer dep overrides to frontends/postgres for standalone compatibility.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>