Fix npm audit vulnerabilities; commit package-lock.json

[chalin]

• Contributes to Harden CI workflows: pin actions, verify binary download, scope token permissions, fix missing install step #177
• Clears all 4 criticals + most highs of the 53 npm audit findings (was 4 critical / 29 high): hugo-extended 0.147.6 → 0.164.0 (its decompress chain carried three critical zip-extraction advisories), netlify-cli 22 → 27, an adm-zip ^0.6.0 override, and an in-range npm audit fix.
• Commits package-lock.json (un-gitignored): without a committed lock, installs re-resolve dependencies and audit posture drifts; this is standard supply-chain hygiene for sites.
• Remaining 9 highs are one chain: netlify-cli's bundled dev-server deps (sharp, image-size, extract-zip, …), fixed only in netlify-cli 27.3.0 — published today, so left to a follow-up bump once it has aged; local-dev-only exposure.
• Verified: Hugo 0.164 builds the site cleanly (a few Hugo deprecation WARNs, pre-existing config keys; nothing blocking) and npm test (format + link check) passes.