chore(backend): consolidate to a single npm lockfile and remove the dead src/quest module

[RUKAYAT-CODER]

Step 1 (partial): consolidation — safe wins

Two low-risk consolidation changes, validated by CI.

1. Single backend lockfile (npm)

CI installs the backend with npm ci (see backend-ci, backend-lint, backend-integration), so npm/package-lock.json is the real standard. This removes the stray, tracked bun.lock. (pnpm-lock.yaml is already gitignored/untracked, so nothing to remove there.) The TypeORM migration npm-scripts still invoke Bun; that is unchanged and independent of the lockfile.

2. Remove the dead src/quest/ module

The repo had three quest locations. Only src/modules/quests/ is wired (app.module.ts → QuestsModule, and src/database/data-source.ts uses its Quest entity). src/quest/ (this deletion) had zero importers anywhere and was not registered in any module — a genuine orphan duplicate. Entities are loaded explicitly in data-source.ts (no glob), so removing it cannot affect entity metadata.

Explicitly NOT touched (needs a real refactor)

src/quests/ (top-level) is not dead — its Quest entity is imported by auth, jobs, submissions, and users — and it appears to be a second Quest entity distinct from src/modules/quests/entities/quest.entity.ts (the one the data source registers). Unifying those two is a genuine entity-consolidation refactor with real behavior risk; it should be done with a local build + migration review, so it is intentionally left for a dedicated follow-up rather than bundled here.

Validation

I could not build locally (no toolchain), so I relied on static analysis (import graph + explicit entity loading) and am using CI to validate this removal. If backend CI goes red, the src/quest/ deletion should be reverted.