bug: setup.sh installs deps from app/ after workspace root was promoted to repo root (#53)

[CoderCoco]

Summary

setup.sh runs cd "$SCRIPT_DIR/app" && npm ci to install dependencies, but PR #53 moved the npm workspace root from app/ up to the repo root (game-server-deploy/). The result is that npm ci runs against the stale app/package-lock.json and installs packages into app/node_modules/, which is now an orphaned location — the root-level workspace never populates it with hoisted packages.

Symptoms

Running make update (or ./setup.sh / ./setup.sh deploy) fails during the Lambda build step with TypeScript TS2307: Cannot find module errors for every @aws-sdk package imported by @gsd/shared:

src/ddb/client.ts:1:32 - error TS2307: Cannot find module '@aws-sdk/client-dynamodb' or its corresponding type declarations.
src/ddb/client.ts:2:40 - error TS2307: Cannot find module '@aws-sdk/lib-dynamodb' or its corresponding type declarations.
src/ddb/configStore.ts:1:40 - error TS2307: Cannot find module '@aws-sdk/lib-dynamodb' or its corresponding type declarations.
src/ddb/pendingStore.ts:1:55 - error TS2307: Cannot find module '@aws-sdk/lib-dynamodb' or its corresponding type declarations.
src/secrets/secretsStore.ts:5:8 - error TS2307: Cannot find module '@aws-sdk/client-secrets-manager' or its corresponding type declarations.

The packages are correctly declared in both app/packages/shared/package.json and the root package-lock.json, but app/node_modules/@aws-sdk/ is never populated because install runs in the wrong directory.

Root cause

Since #53, the workspace hierarchy is:

game-server-deploy/          ← workspace root (package.json + package-lock.json live here)
  app/                       ← workspace member (stale app/package-lock.json still present)
    packages/shared/
    packages/lambda/*/
    ...

setup.sh still does:

cd "$SCRIPT_DIR/app"
npm ci                    # wrong directory — root is now the workspace root
npm run build:lambdas     # wrong script — root exposes app:build:lambdas alias

Running npm ci inside a workspace member directory (rather than the workspace root) does not correctly hoist and install all workspace dependencies.

The deploy subcommand has the same issue: it jumps into app/ and calls npm run build:lambdas directly, bypassing the root-level app:build:lambdas alias.

Fix

Update setup.sh so both bootstrap and deploy operate from the repo root ($SCRIPT_DIR):

# bootstrap
cd "$SCRIPT_DIR"          # was: cd "$SCRIPT_DIR/app"
npm ci
npm run app:build:lambdas # was: npm run build:lambdas

# deploy
cd "$SCRIPT_DIR"          # was: cd "$SCRIPT_DIR/app"
npm run app:build:lambdas # was: npm run build:lambdas

The terraform steps that follow in bootstrap already use cd "$SCRIPT_DIR/terraform" and are unaffected.

The stale app/package-lock.json should also be removed (or kept only as a legacy artifact with a comment) to avoid confusing npm in the future.

Verification

Running npm ci at the repo root followed by npm run app:build:lambdas produces a clean build with all Lambda bundles emitting successfully.