Add NPM package-lock.json

The Yarn package lock file was removed in #187,
but I didn't add the new NPM `package-lock.json`, but it is required.

Re-add the 'relocate lockfile dir' logic.

Enable reportNewPackageLock so KGP creates an error if the lockfile is missing (otherwise it generates a new one and doesn't complain, which obscures the fact that one is missing!)

buildSrc/src/main/kotlin/buildsrc/conventions/lang/kotlin-multiplatform-js.gradle.kts

@@ -1,5 +1,7 @@
 package buildsrc.conventions.lang
 
+import org.jetbrains.kotlin.gradle.targets.js.npm.NpmExtension
+
 /** conventions for a Kotlin/JS subproject */
 
 plugins {
@@ -12,3 +14,16 @@ kotlin {
         nodejs()
     }
 }
+
+afterEvaluate {
+    rootProject.extensions.configure<NpmExtension> {
+        // Kotlin/JS creates lockfiles for JS dependencies in the root directory.
+        // I think it's a bit annoying to have a top-level directory for a single file, and it makes the project
+        // a bit more crowded.
+        // It's a little neater if the lock file dir is in the Gradle dir, next to the version catalog.
+        lockFileDirectory = project.rootDir.resolve("gradle/kotlin-js-store")
+
+        // produce an error if there's no lock file
+        reportNewPackageLock = true
+    }
+}