Cut the node_modules prose to one home each; drop a stray tracked file

AGENTS.md

@@ -319,22 +319,11 @@ them. Revisit only if the stated reason stops holding.
   `e2e-tests/playwright.config.ts`). The rest write users, groups and sessions to one shared backend,
   where a second engine's run would race the first, so widening them means giving each engine its own
   stack. Screenshots are written per project name for the same reason. Decided 2026-08-05.
-- **Deps install to `/node_modules`, one level above `WORKDIR /app`** — Node resolves bare specifiers
-  upward, so dev's `.:/app` bind mount has nothing to shadow. The usual fix, a volume at
-  `/app/node_modules`, is what this replaces: the daemon creates a missing mount destination **as
-  root whatever user the container runs as** (verified — `--user 1000:1000` still yields a root-owned
-  dir), so it left an empty root-owned `node_modules/` sitting in the developer's own checkout, and
-  the anonymous volume also went stale on a dep bump until `down -v`. Consequences worth knowing:
-  nothing may mount inside `/app` at that path again (locked by `src/compose.test.ts`); a path built
-  as `<repo>/node_modules` no longer resolves, so `src/ui/icons.test.ts` locates lucide-static by
-  specifier via `import.meta.resolve`; and `npm install` must not run in `/app` or it recreates the
-  problem — README → Extending the core documents `--package-lock-only` plus `--user` instead, which
-  is also why the image sets `npm_config_cache` (the host uid has no home dir here). Nothing masks
-  that path any more, so anything at `/app/node_modules` now **shadows `/node_modules` silently** —
-  wrong dependency code, no warning, and CI stays green because a fresh clone has none. An empty
-  leftover dir is harmless (resolution falls through); a populated one from the superseded root
-  `npm install` needs `sudo` to remove, which is worse than the bug this replaced. `.dockerignore`'s
-  `node_modules` line is what keeps a builder's stray copy out of the image. Decided 2026-08-05.
+- **Deps install to `/node_modules`, above `WORKDIR /app`** — Node resolves upward, so dev's `.:/app`
+  bind mount has nothing to shadow. Not a volume at `/app/node_modules`: the daemon creates a mount
+  destination as root whatever `--user` says, leaving a root-owned dir in the checkout. Nothing may
+  sit at that path now — it shadows `/node_modules` silently (`src/compose.test.ts` guards the compose
+  files, `.dockerignore` the image). Decided 2026-08-05.
 
 ## Docker only — no host tooling