Add package-lock.json, fix terser vuln, add hacs filename

- Generate package-lock.json so CI can use npm ci
- Bump @rollup/plugin-terser 0.4 → 1.0 (fixes serialize-javascript RCE)
- Add filename field to hacs.json for HACS asset resolution

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: squizzer73

hacs.json

@@ -1,6 +1,7 @@
 {
   "name": "House Card",
   "description": "A visual house floorplan card for Home Assistant with grid-based room layout and entity state display.",
+  "filename": "house-card.js",
   "render_readme": true,
   "domains": [],
   "iot_class": "local_polling",