Drop npm lockfile and update Express

package-lock.json was added for CI in 69cf0c0, but the generated lockfile keeps causing local churn and Dependabot noise. Return it to an ignored local artifact and keep the security fix in package.json by bumping Express to 4.22.2, which pulls the patched qs range.

Author: MoneroOcean

.gitignore

@@ -13,6 +13,9 @@ _*.js
 *~
 *.un~
 
+# Untracked dependency locks
+package-lock.json
+
 # Local runtime config and TLS files
 cert*
 config.json