Pin supported Node version via package.json "engines" field

[nojibe]

Problem

The Node version is pinned in .nvmrc but package.json has no engines field. Contributors and CI can silently run on an unsupported Node version. packageManager correctly pins pnpm@9.6.0, but there is no equivalent guardrail for Node.

Proposed change

• Add an engines field to package.json matching .nvmrc (e.g. "node": ">=18 <21" or the exact supported range)
• Optionally set engine-strict=true in .npmrc / document it so mismatches fail fast

Acceptance criteria

• engines.node present and consistent with .nvmrc and the CI Node version
• Version range is intentional (matches what the app is tested against)