fix(web): make apps/web self-describing for the Railpack build (#1)

Dokploy builds only the `apps/web` build path, so Railpack never sees the
root `bun.lock`. `apps/web/package.json` also had no `packageManager` field,
so Railpack fell back to npm — with no lockfile in scope, `npm install` died
with:

    npm error Cannot read properties of null (reading 'edgesOut')

Reproduced locally with the same toolchain Railpack uses (node 22.23.2 /
npm 10.9.8) against `apps/web/package.json` alone.

- Pin `packageManager: bun@1.3.14` in apps/web/package.json (matching the repo
  root) so Railpack selects bun.
- Commit a standalone `apps/web/bun.lock`, generated with bun 1.3.14, so
  `bun install --frozen-lockfile` has a lockfile in the build context.

Verified by copying only package.json + bun.lock into a clean linux/amd64
container (matching the builder) and running `bun install --frozen-lockfile`:
693 packages installed.

Also corrects the design doc, which claimed the root `bun.lock` would ensure
resolution — that is false for a subdirectory build path, and nothing
documented the need for a standalone lockfile.

apps/web/package.json

@@ -2,6 +2,7 @@
   "name": "@deckyvault/web",
   "version": "2026.2.2",
   "private": true,
+  "packageManager": "bun@1.3.14",
   "scripts": {
     "dev": "next dev --experimental-https --webpack",
     "build": "next build --webpack",