fix(npm): restore web's @nous-research/ui 0.18.2 pin and lockfile integrity

[ocfox]

Problem

nix build .#messaging fails with ENOTCACHED on @nous-research/ui. The web/node_modules/@nous-research/ui entry in package-lock.json lost its resolved and integrity in 390a1771b, and importNpmLock prefetches from those hashes, so npm reaches for the network inside the sandbox. Every npm-dependent output is affected; it surfaces in hermes-tui only because the whole workspace installs in one pass.

515e88a80 separately set web/package.json to 0.16.0 while the lockfile still installs 0.18.2 under web/, so npm ls --depth=0 reports ELSPROBLEMS.

Fix

Restore the two lockfile fields, and put web's pin back to 0.18.2 — the version it has resolved to since a51a7b9b9. 0.16.0 ships none of the hooks/use-* and ui/components/* modules web imports (117 TS2307s).

Verified with nix build .#messaging, npm ls --depth=0 and npm --prefix web run typecheck on NixOS x86_64-linux.

[teknium1]

Thanks for the targeted lockfile repair. Static review confirms that current main still declares @nous-research/ui as 0.16.0 in web/package.json:19, while package-lock.json:18773 resolves the web-local package as 0.18.2 without resolved or integrity fields. nix/lib.nix:172-176 makes that omission material because the shared offline importNpmLock dependency derivation consumes lockfile integrity hashes.

The PR aligns both Web declarations at 0.18.2 and uses the exact resolved URL and integrity published by the npm registry for that version. A scan of the current lockfile found no other non-link node_modules entry missing both fields, so the patch covers the identified omission without unrelated lock churn. Current main is only one documentation commit past the PR base, so the two-file patch should salvage cleanly.

No changes requested. This is an automated hermes-sweeper review.

[thattemperature]

This fixes the nix build failure for me. Thanks very much.

[ocfox]

already fixed