Pin extract-zip to a yauzl that can read the Electron archive

[Ikromjon1998]

The separate PR you asked for in #150. This is the second half of #145: with .npmrc merged, Electron's postinstall now runs — but on a clean install the runtime still does not land.

What happens

extract-zip resolves its own nested yauzl 2.10.0, which stalls partway through inflating a large deflated entry: it stops emitting data and never fires end, error or close. Electron's postinstall unzips the runtime with it, so extraction stops after the first entry and leaves:

node_modules/electron/dist/
└── LICENSES.chromium.html      # and nothing else

install.js still exits 0 and npm reports success, so nothing surfaces the problem until the app fails on a missing Electron.app/Contents/Info.plist — an error that names the wrong culprit.

The archive is not at fault: unzip -t reports all 585 entries intact on the same cached download.

Why the existing dependency doesn't cover it

resources/electron/package.json already requires yauzl: ^3.3.2, but that does not reach extract-zip, which pins its own copy through ^2.10.0 — and Node resolves a nested copy in preference to the hoisted one. The override scopes the fix to the single place still on the broken release, leaving the top-level dependency untouched.

Verified

npm ci in resources/electron, under a parent .npmrc containing ignore-scripts=true to match the Laravel 12 skeleton. Same command both times; only the override differs:

	yauzl	files in dist	result
before	2.10.0	1	no binary
after	3.4.0	261	Electron --version → v40.10.2

Both installs exit 0, which is why this is easy to miss.

On the lockfile

Regenerated with npm install --package-lock-only. The diff is limited to the yauzl entry and the two transitive packages it no longer needs (buffer-crc32, fd-slicer) — nothing else re-resolved.