fix: web 打包改用 Node 18 与 legacy-peer-deps，规避 npm edgesOut 错误

Co-authored-by: Cursor <cursoragent@cursor.com>

.drone.yml

@@ -36,15 +36,17 @@ steps:
       - ls -lh "/hzdyjs-releases/${DRONE_TAG}/backend-${DRONE_TAG}.jar"
 
   - name: package-web
-    image: node:20-bookworm
+    # Node 20 + 无 lock 时 npm 易触发 edgesOut 空指针；18 + legacy-peer-deps 更稳
+    image: node:18-bookworm
     environment:
       NPM_CONFIG_REGISTRY: https://registry.npmmirror.com
     commands:
       - set -eu
-      - echo "==> web tag=${DRONE_TAG}"
+      - echo "==> web tag=${DRONE_TAG} npm=$(npm -v) node=$(node -v)"
       - mkdir -p "/hzdyjs-releases/${DRONE_TAG}"
       - cd web
-      - npm ci
+      # package-lock.json 被 gitignore，仓库内无 lock
+      - npm install --legacy-peer-deps --no-audit --no-fund
       - npm run build:prod
       - test -f dist/index.html
       - tar -C dist -czf "/hzdyjs-releases/${DRONE_TAG}/web-${DRONE_TAG}.tar.gz" .

docs/superpowers/specs/2026-10-24-drone-tag-package-design.md

@@ -43,7 +43,8 @@
    源文件：`backend/ruoyi-admin/target/ruoyi-admin.jar` → `backend-<tag>.jar`
 
 2. **web**（`node:20-bookworm`）  
-   `npm ci` → `npm run build:prod`  
+   `npm install` → `npm run build:prod`  
+   （`web/package-lock.json` 被 gitignore，仓库无 lock，不能用 `npm ci`）  
    打包 `web/dist` → `web-<tag>.tar.gz`
 
 3. **mobile**（`node:20-bookworm` + corepack/pnpm）