chore: stop installing with --legacy-peer-deps

[adamjohnwright]

You were right that it reads like a workaround. It is one, and the tree stopped
needing it a long time ago.

It is not needed

Measured today on main, in a clean directory:

npm ci --no-audit --no-fund      → added 2109 packages in 41s
npm install --no-audit --no-fund → added 2109 packages in 42s, lockfile unchanged

No flag, no failure. It appears to have come in with the first CI pipeline and was
never revisited.

It was not free

The flag accepts an inconsistent dependency tree, so a bump that cannot resolve
at all passed every check. Angular's packages peer-depend on one another at
exact versions; dependabot's group (#161) moved eleven of them and left
platform-browser-dynamic and compiler-cli behind:

Conflicting peer dependency: @angular/core@21.2.23
  peer @angular/core@"21.2.23" from @angular/platform-browser-dynamic@21.2.23

Six green checks. The only thing that objected was this repo's pre-push hook,
which runs npm ci without the flag — so the gate existed on a developer's
machine and not in CI, which is exactly backwards.

What changes

--legacy-peer-deps is removed from CI, deploy, release verification, the
Dockerfile and the local setup guide. CONTRIBUTING says why, so it is not added
back the next time an install fails on peers:

If an install fails on peer dependencies, the tree is wrong. Fix the versions
rather than telling npm to stop checking.

What this will do

It will make some future dependabot PRs fail, including #161 as it stands. That
is the point — they fail now at the PR that introduces them, rather than passing
and leaving a tree that only installs when you ask npm not to look.

Deliberately not in this PR

The Dockerfile still uses npm install rather than npm ci. Reproducible
container builds are worth having and are a separate change from this one — I
started making it, noticed it was scope creep, and put it back.

🤖 Generated with Claude Code

[adamjohnwright]

Do not merge this as it stands — the premise is wrong.

I claimed --legacy-peer-deps was vestigial because npm ci resolved strictly
here. It does, on npm 11.12.1 (Node 24), which is what this machine runs. CI
runs Node 22 / npm 10.9.8, and there it is load-bearing:

npm 10, npm ci --ignore-scripts                    → Cannot read properties of null (reading 'edgesOut')
npm 10, npm ci --ignore-scripts --legacy-peer-deps → added 2336 packages
npm 11, npm ci --ignore-scripts                    → works

So removing the flag breaks every CI run, which is exactly what this branch has
been doing all day.

What the finding is actually worth

The underlying point still holds — the flag masks broken dependency trees, and it
hid #161's inconsistent Angular set. But the fix is not to remove the flag under
an npm that cannot cope without it.

The real fix is to align CI's Node with what developers run. CI is on 22
while local is on 24; the lockfile in main was last written by npm 11 (#214),
which is plausibly why npm 10 chokes on it. Matching them would make strictness
achievable and stop lockfiles being written by one npm and consumed by another.

That deserves its own PR with its own testing, so this one should wait for it
rather than land and be reverted.

Correction

This is the second claim I have made from the wrong instrument today. Testing an
npm-version-sensitive behaviour on a different npm version than CI uses is not a
test of CI.

[adamjohnwright]

Measured while moving the project to Node 24 (#218), so the cost of dropping
this flag is now known rather than guessed.

The blocker is one package. @analogjs/vitest-angular@2.3.1 pins vitest 3,
while @angular/build wants vitest 4:

While resolving: @angular/build@21.2.24
Found: vitest@3.2.7
  peer vitest@"^1.3.1 || ^2.0.0 || ^3.0.0 || ^4.0.0" from @analogjs/vitest-angular@2.3.1
Conflicting peer dependency: vitest@4.1.11

Letting npm re-resolve to clear it does work — a real npm ci with no flag
succeeds on Node 24 / npm 11 — but the resolution that makes it succeed moves
@analogjs/vitest-angular 2.3.1 → 2.7.2 and drags 207 top-level version
changes with it, including:

• react 18.3.1 → 19.3.0 and react-dom 18.3.1 → 19.3.0
• @angular-devkit/core and @angular-devkit/schematics 21.2.24 → 22.1.8
• vite 6.4.3 → 7.3.6, zod 3.25.76 → 4.3.6, uuid 8.3.2 → 14.0.2
• and a batch of downgrades: clsx 2.1.1 → 1.2.1, @types/node 25.2.0 →
  22.20.3, cosmiconfig 9.0.2 → 8.3.6

By contrast, keeping the flag and regenerating under npm 11 changes no
package's version at all — 91 optional platform entries added, 0 removed,
0 changed.

So this is not a cleanup that can ride along with a Node bump. The honest
version of this issue is "move @analogjs/vitest-angular forward deliberately,
then drop the flag", and that wants its own PR with the unit suite watched,
because it is the test runner integration that moves.

#218 therefore keeps --legacy-peer-deps and records why in
scripts/preflight.sh, which was previously running without the flag and so
failing on this exact conflict locally while CI never saw it.