fix(deps): pin tsx to 4.21.0 — 4.22.x breaks CJS extensionless resolution

tsx 4.22.x regressed its runtime resolver: extensionless require()s inside
dependencies get a `.jsx` extension appended, so ajv's
require("./compile/index") resolves to a non-existent index.jsx and throws
MODULE_NOT_FOUND. This crash-loops every tsx-run service (apps/api,
data-manager) at boot — fastify pulls @fastify/ajv-compiler → ajv on startup.

Not caught by check-types/tests/web build: only the tsx runtime CJS resolver
hits this path. Surfaced on deploy when app-api + data-manager restart-looped.

Pin via override to 4.21.0 (known-good, what prod ran before the dep sweep)
until fixed upstream.

Author: Medformatik

pnpm-lock.yaml

@@ -57,3 +57,9 @@ overrides:
   # publisher) satisfies commitlint's `^1.0.0` range, so pin to it until
   # tinyexec regains trusted-publisher evidence on a newer release.
   "tinyexec": "1.1.2"
+  # tsx 4.22.x regressed CJS extensionless resolution: its loader appends `.jsx`
+  # to extensionless `require()`s inside deps (e.g. ajv's `require("./compile/index")`
+  # resolves to a non-existent `index.jsx`), crash-looping the tsx-run services
+  # (apps/api, data-manager) at boot. 4.21.0 is the known-good version. Pin until
+  # the regression is fixed upstream (https://github.com/privatenumber/tsx).
+  "tsx": "4.21.0"