chore: record the project's own licence in the lockfile

[FHoffarth]

package.json and LICENSE both say MIT. package-lock.json still carried npm's ISC
default from before the licence was chosen, so npm reconciled the two on every run and
rewrote the lockfile — leaving the working tree dirty for no reason.

That is the same false signal the audit suite was just cured of in #2 and #4: a tracked
file that changes by itself when you run an ordinary command teaches you to ignore a dirty
tree, which is exactly what the evidence chain relies on you not doing.

The change

One line, produced by npm install --package-lock-only rather than edited by hand:

     "": {
       "name": "filepass",
       "version": "0.1.0",
-      "license": "ISC",
+      "license": "MIT",

Only the root package entry changes. No dependency, version, integrity hash or resolved
URL is touched, and the ~180 license fields belonging to dependencies are untouched.

Evidence

Gate	Result
Product tests	5 files / 43 tests passed
Audit tests	21 files / 296 tests passed
tsc --noEmit	clean
vite build	built in 902ms
npm audit --audit-level=high	0 vulnerabilities
git diff --check	clean
npm ci against the corrected lockfile	added 125 packages, 0 vulnerabilities
npm install on the committed tree, then git status --porcelain	empty

The last row is the point of the PR: before, that command left package-lock.json modified.

Merge gate

Full product and audit suites pass, and npm install on the committed tree leaves
git status --porcelain empty.

No product, parser, verification or test logic is touched. No tag, release or deploy
proposed.

🤖 Generated with Claude Code