fix(iap): resolve the lockfile against registry.npmjs.org

`npm ci` failed in CI with ENOTFOUND npm.dev.wixpress.com: 44 tarball
URLs in package-lock.json pointed at Wix's internal mirror rather than
npmjs. They were written by a local `npm install` that picked up a
user-level `registry=` setting.

CI reaches npm by pinning registry.npmjs.org to the Wix embargo gateway
in /etc/hosts (.github/actions/wix-gateway-proxy), so the lockfile has
to name registry.npmjs.org — the internal host is not resolvable there.

Rewrites the host back. Integrity hashes are unchanged and still valid,
since both registries serve identical tarballs; verified by a clean
`npm ci` over all 406 packages.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: eyalizhaki