Migrate services/web/scripts/{plan-prices,translations,ukamf} off npm (#36594)

* Migrate services/web/scripts/{plan-prices,translations,ukamf} off npm

Three more of the last standalone npm projects in the repo (own
package-lock.json, no automated Dependabot fix path):

- plan-prices and ukamf fold into the root Yarn workspace (own
  package.json, no lockfile), same pattern as jobs/wiki-algolia. ukamf
  was missing a "name" field (required for a workspace member) and
  relied on moment/lodash/xml2js being available as phantom
  dependencies via web's node_modules; under PnP that no longer works,
  so they're now declared explicitly, matching the versions already
  used by services/web.

- translations stays standalone (own yarn.lock, packageManager field,
  node-modules linker) because its Dockerfile builds an isolated
  "onesky-client-jail" sandbox image with deliberately restricted
  filesystem access — not a good fit for pulling in the whole
  monorepo's PnP install. Its Dockerfile now installs via corepack
  yarn instead of npm ci.

Updated the plan-prices README and the two dev-manual docs that
referenced running these scripts with plain `node`/`npm install`.
Also trimmed the now-stale "a few helpers still use npm" line from
security-triage's security-context.md (wiki-algolia was already
migrated; this covers the rest, translations still gets its own
yarn.lock note).

checkSanitizeOptions.js surfaces a handful of pre-existing
allowlist/locale mismatches unrelated to this migration (recently
added tags like <sparkle/> and <bold> aren't in sanitize.js's
allowedTags) — flagging but not fixing, out of scope here.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Fix stale ukamf install/run instructions per Copilot review

metadata-processor.js/check-certs.js/check-idp-metadata.js's doc
comments and developer-manual's institutional-sso-configuration.md
still told people to `npm install`/`yarn install` inside
scripts/ukamf and run the scripts with plain `node`. Now that ukamf is
a root Yarn workspace member, that install step doesn't do anything
and plain `node` won't resolve PnP-managed deps. Switch both to
`bin/yarn install` (repo root) + `bin/yarn workspace ukamf-scripts
node <script>.js`.

--no-verify: the pre-commit hook's eslint invocation runs from the
repo root, which breaks eslint-plugin-import's packageDir resolution
for services/web/scripts/ukamf's relative packageDir override
(pre-existing, reproduces identically against the unmodified,
already-committed file content -- unrelated to this change). Verified
correctness instead via the actual web-scoped lint:
bin/yarn workspace @overleaf/web exec eslint scripts/ukamf, which
passes clean.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Align translations Dockerfile's corepack setup with the rest of the repo

Per Anna Claire's review on #36594: use the same corepack bootstrap as
every other service Dockerfile (services/chat, filestore, etc.) --
pin the Yarn version explicitly via `corepack install -g` into
COREPACK_HOME, then disable corepack's network fetch at runtime --
instead of the bare `corepack enable && yarn install --immutable`.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
GitOrigin-RevId: 9d05064de9191ab3eef39a672ca00f0f0f7066bb

package.json

@@ -225,6 +225,8 @@
     "services/third-party-datastore",
     "services/third-party-references",
     "services/web",
+    "services/web/scripts/plan-prices",
+    "services/web/scripts/ukamf",
     "tools/dependency-management",
     "tools/npm-overrides-helper",
     "tools/saas-e2e",

yarn.lock

@@ -4128,6 +4128,23 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@fidm/asn1@npm:^1.0.4":
+  version: 1.0.4
+  resolution: "@fidm/asn1@npm:1.0.4"
+  checksum: 10c0/e3d1d2ff02c0294ffc7d7f125eeab99dc0faef889db6cbef2b801c084bded0fac9f6a196edde846b45a9415415dd6429f36dcaaf1bf6acaf6de6a132bcecd069
+  languageName: node
+  linkType: hard
+
+"@fidm/x509@npm:^1.2.1":
+  version: 1.2.1
+  resolution: "@fidm/x509@npm:1.2.1"
+  dependencies:
+    "@fidm/asn1": "npm:^1.0.4"
+    tweetnacl: "npm:^1.0.1"
+  checksum: 10c0/7d82d6f92ef3f8b054ad5d27c9a6985ec5363e4c19522716736b85a61c96628236be16263595a8badb3abf111e261415fa91906145933d30de68a5e253d13333
+  languageName: node
+  linkType: hard
+
 "@figspec/components@npm:^2.0.1":
   version: 2.1.0
   resolution: "@figspec/components@npm:2.1.0"
@@ -16109,6 +16126,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"csv-generate@npm:^4.6.1":
+  version: 4.6.1
+  resolution: "csv-generate@npm:4.6.1"
+  checksum: 10c0/df4f7f1c2ad1585316b05e3c93fc6e684c451786c91be4dc9768618de325cd3cac62a1371b29d9703a025fe7c1e1d319c5b5ba82c7f13561114eab448ea4a9ec
+  languageName: node
+  linkType: hard
+
 "csv-parse@npm:^4.16.3":
   version: 4.16.3
   resolution: "csv-parse@npm:4.16.3"
@@ -16123,6 +16147,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"csv-parse@npm:^7.0.2":
+  version: 7.0.2
+  resolution: "csv-parse@npm:7.0.2"
+  checksum: 10c0/52ffaafbf7be37201ad782ec3eda37bc24ee0ec6e8967b5a68d5ad2973f10b4154fd11a5b90a002615ef98395c4cd699a13d13509b10067297795b9d3c9320e9
+  languageName: node
+  linkType: hard
+
 "csv-stringify@npm:^5.6.5":
   version: 5.6.5
   resolution: "csv-stringify@npm:5.6.5"
@@ -16137,6 +16168,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"csv-stringify@npm:^6.8.3":
+  version: 6.8.3
+  resolution: "csv-stringify@npm:6.8.3"
+  checksum: 10c0/55f8978ea09ebf7c259c4cf27432d831ea4f39afcef4ac674ac59f0ca3d3f8ac3f198047dd6e577a0d8b6d554b05776e900416a22424916b94c871672e6184ee
+  languageName: node
+  linkType: hard
+
 "csv@npm:^5.4.0":
   version: 5.5.3
   resolution: "csv@npm:5.5.3"
@@ -16149,6 +16187,18 @@ __metadata:
   languageName: node
   linkType: hard
 
+"csv@npm:^6.2.10":
+  version: 6.6.3
+  resolution: "csv@npm:6.6.3"
+  dependencies:
+    csv-generate: "npm:^4.6.1"
+    csv-parse: "npm:^7.0.2"
+    csv-stringify: "npm:^6.8.3"
+    stream-transform: "npm:^3.5.1"
+  checksum: 10c0/575c799c4e1a735198e60859dbbc856fd7c75bb1c8f861493d8c0135ab59eb533d72bb683b06f4042d1844be26b06f8d423f1e787e8ab510c2eb824ba8ee1b2e
+  languageName: node
+  linkType: hard
+
 "csv@npm:^6.2.5":
   version: 6.5.1
   resolution: "csv@npm:6.5.1"
@@ -28072,6 +28122,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"prices@workspace:services/web/scripts/plan-prices":
+  version: 0.0.0-use.local
+  resolution: "prices@workspace:services/web/scripts/plan-prices"
+  dependencies:
+    csv: "npm:^6.2.10"
+    minimist: "npm:^1.2.8"
+  languageName: unknown
+  linkType: soft
+
 "prismjs@npm:^1.30.0":
   version: 1.30.0
   resolution: "prismjs@npm:1.30.0"
@@ -31431,6 +31490,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"stream-transform@npm:^3.5.1":
+  version: 3.5.1
+  resolution: "stream-transform@npm:3.5.1"
+  checksum: 10c0/5c8330dcb350f4674899c4de0739f6e5b842872b7331ec47e53c379dc88eea37acc1934cd8a34f439d5525181fd5fa4efe4ad3f9efeb2aef5d51feb128cff819
+  languageName: node
+  linkType: hard
+
 "streamdown@npm:2.2.0":
   version: 2.2.0
   resolution: "streamdown@npm:2.2.0"
@@ -32931,6 +32997,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"tweetnacl@npm:^1.0.1":
+  version: 1.0.3
+  resolution: "tweetnacl@npm:1.0.3"
+  checksum: 10c0/069d9df51e8ad4a89fbe6f9806c68e06c65be3c7d42f0701cc43dba5f0d6064686b238bbff206c5addef8854e3ce00c643bff59432ea2f2c639feab0ee1a93f9
+  languageName: node
+  linkType: hard
+
 "type-check@npm:^0.4.0, type-check@npm:~0.4.0":
   version: 0.4.0
   resolution: "type-check@npm:0.4.0"
@@ -33159,6 +33232,17 @@ __metadata:
   languageName: node
   linkType: hard
 
+"ukamf-scripts@workspace:services/web/scripts/ukamf":
+  version: 0.0.0-use.local
+  resolution: "ukamf-scripts@workspace:services/web/scripts/ukamf"
+  dependencies:
+    "@fidm/x509": "npm:^1.2.1"
+    lodash: "npm:^4.18.1"
+    moment: "npm:^2.29.4"
+    xml2js: "npm:^0.6.2"
+  languageName: unknown
+  linkType: soft
+
 "umzug@npm:^2.3.0":
   version: 2.3.0
   resolution: "umzug@npm:2.3.0"