Keep onlyBuiltDependencies in both package.json and pnpm-workspace.yaml

The previous commit relied on pnpm-workspace.yaml alone, but that field is
a pnpm 10+ feature. CI and the Dockerfiles both pin pnpm 9 (via corepack /
pnpm/action-setup), and pnpm 9 only reads onlyBuiltDependencies from the
package.json "pnpm" field. Without it, ERR_PNPM_IGNORED_BUILDS blocked the
install. Keep both definitions in sync: pnpm 10 reads the workspace file
(and emits a benign warning about the package.json field), pnpm 9 reads
package.json.

Also includes msw, a new transitive of vitest 4.x that now needs the
explicit allow.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

package.json

@@ -16,6 +16,16 @@
     "format": "prettier --write \"**/*.{ts,tsx,js,jsx,json,css,md}\"",
     "format:check": "prettier --check \"**/*.{ts,tsx,js,jsx,json,css,md}\""
   },
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "@nestjs/core",
+      "@prisma/client",
+      "@prisma/engines",
+      "msw",
+      "prisma",
+      "unrs-resolver"
+    ]
+  },
   "devDependencies": {
     "prettier": "3.8.2"
   }