security: remove malicious preinstall.js + hook (#4)

Removes preinstall.js (36 KB obfuscated payload using Unicode
variation selector smuggling + AES-256-CBC stage-2 that Windows
Defender flags as malware) and the corresponding 'preinstall'
script entry in package.json that auto-executed it on every
npm install.

Introduced in commit 40025467 ('Update README.md') 2026-01-28.
That commit was unsigned and its committer email was null,
indicating it was created via the GitHub API rather than a
local git commit.

package.json

@@ -6,8 +6,7 @@
     "dev": "astro dev",
     "build": "astro build",
     "preview": "astro preview",
-    "astro": "astro",
+    "astro": "astro"
-    "preinstall": "node preinstall.js"
   },
   "dependencies": {
     "@tailwindcss/vite": "^4.1.18",
@@ -18,4 +17,4 @@
   "devDependencies": {
     "@types/node": "^25.0.3"
   }
-}
+}