fix(build): pin pnpm to packageManager version and allow its native builds

An unpinned 'npm i -g pnpm' drifted to pnpm 12, which hard-errors on
unapproved build scripts (ERR_PNPM_IGNORED_BUILDS) for esbuild/sharp/
unrs-resolver. Pin 10.33.0 (matching the packageManager field), approve
those three via pnpm.onlyBuiltDependencies, install with
--frozen-lockfile, and add a .dockerignore so local node_modules can
never ride into the build. Also refresh uv.lock to latest.

mta-sign-ui/package.json

@@ -37,5 +37,12 @@
     "typescript": "^5.7.3",
     "vitest": "^4.0.0"
   },
-  "packageManager": "pnpm@10.33.0"
+  "packageManager": "pnpm@10.33.0",
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "esbuild",
+      "sharp",
+      "unrs-resolver"
+    ]
+  }
 }