Migrate services/web/scripts/{plan-prices,translations,ukamf} off npm (#36594)

* Migrate services/web/scripts/{plan-prices,translations,ukamf} off npm

Three more of the last standalone npm projects in the repo (own
package-lock.json, no automated Dependabot fix path):

- plan-prices and ukamf fold into the root Yarn workspace (own
  package.json, no lockfile), same pattern as jobs/wiki-algolia. ukamf
  was missing a "name" field (required for a workspace member) and
  relied on moment/lodash/xml2js being available as phantom
  dependencies via web's node_modules; under PnP that no longer works,
  so they're now declared explicitly, matching the versions already
  used by services/web.

- translations stays standalone (own yarn.lock, packageManager field,
  node-modules linker) because its Dockerfile builds an isolated
  "onesky-client-jail" sandbox image with deliberately restricted
  filesystem access — not a good fit for pulling in the whole
  monorepo's PnP install. Its Dockerfile now installs via corepack
  yarn instead of npm ci.

Updated the plan-prices README and the two dev-manual docs that
referenced running these scripts with plain `node`/`npm install`.
Also trimmed the now-stale "a few helpers still use npm" line from
security-triage's security-context.md (wiki-algolia was already
migrated; this covers the rest, translations still gets its own
yarn.lock note).

checkSanitizeOptions.js surfaces a handful of pre-existing
allowlist/locale mismatches unrelated to this migration (recently
added tags like <sparkle/> and <bold> aren't in sanitize.js's
allowedTags) — flagging but not fixing, out of scope here.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Fix stale ukamf install/run instructions per Copilot review

metadata-processor.js/check-certs.js/check-idp-metadata.js's doc
comments and developer-manual's institutional-sso-configuration.md
still told people to `npm install`/`yarn install` inside
scripts/ukamf and run the scripts with plain `node`. Now that ukamf is
a root Yarn workspace member, that install step doesn't do anything
and plain `node` won't resolve PnP-managed deps. Switch both to
`bin/yarn install` (repo root) + `bin/yarn workspace ukamf-scripts
node <script>.js`.

--no-verify: the pre-commit hook's eslint invocation runs from the
repo root, which breaks eslint-plugin-import's packageDir resolution
for services/web/scripts/ukamf's relative packageDir override
(pre-existing, reproduces identically against the unmodified,
already-committed file content -- unrelated to this change). Verified
correctness instead via the actual web-scoped lint:
bin/yarn workspace @overleaf/web exec eslint scripts/ukamf, which
passes clean.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Align translations Dockerfile's corepack setup with the rest of the repo

Per Anna Claire's review on #36594: use the same corepack bootstrap as
every other service Dockerfile (services/chat, filestore, etc.) --
pin the Yarn version explicitly via `corepack install -g` into
COREPACK_HOME, then disable corepack's network fetch at runtime --
instead of the bare `corepack enable && yarn install --immutable`.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
GitOrigin-RevId: 9d05064de9191ab3eef39a672ca00f0f0f7066bb

package.json

@@ -225,6 +225,8 @@
     "services/third-party-datastore",
     "services/third-party-references",
     "services/web",
+    "services/web/scripts/plan-prices",
+    "services/web/scripts/ukamf",
     "tools/dependency-management",
     "tools/npm-overrides-helper",
     "tools/saas-e2e",