security(PTAAA-847, 852, 863, 876, 491): vite 8.3.5, source-map-js 1.2.2, Node 24.22.1, .npmrc fix

.npmrc

@@ -1,10 +1,21 @@
 # Supply-chain security hardening
 # Required by the BrowserStack supply-chain .npmrc audit (Enigma / SC-12282).
 # See: https://browserstack.atlassian.net/wiki/spaces/ENG/pages/6091571922/Supply+Chain+Security+Enhancements+Tech+Spec
+#
+# Keep each comment on its own line: .npmrc has no inline comments, so
+# `key=true   # note` sets the value to the whole string "true   # note".
 
-ignore-scripts=true      # blocks malicious package lifecycle scripts
-strict-ssl=true          # enforces TLS for registry connections
-save-exact=true          # pins exact dependency versions
-audit-level=high         # fail on high+ severity advisories
-engine-strict=true       # refuse incompatible Node engines
-legacy-peer-deps=false   # preserve npm 7+ peer-dependency resolution
+# Block malicious package lifecycle scripts
+ignore-scripts=true
+# Enforce TLS for registry connections
+strict-ssl=true
+# Pin exact dependency versions
+save-exact=true
+# Fail on high+ severity advisories
+audit-level=high
+# Refuse incompatible Node engines
+engine-strict=true
+# Preserve npm 7+ peer-dependency resolution
+legacy-peer-deps=false
+# Wait 7 days before resolving newly published package versions (npm 11.10+)
+min-release-age=7

.nvmrc

@@ -1 +1 @@
-v24.12.0
+v24.22.1