chore: harden npm supply chain

[devrodri-com]

What changed

• Pins direct npm dependencies to exact versions and declares packageManager.
• Adds .npmrc defaults for exact future saves and quieter installs.
• Updates firebase-admin, @vercel/node, and tsx to current stable versions in their existing major lines.
• Adds targeted npm overrides for vulnerable transitive packages instead of changing application code.
• Moves the CI typecheck into npm run build and adds dependency audit gates.
• Adds a supply-chain hardening runbook for manual rotation and Vercel env checks.

Risk reduction

• Production dependency audit is reduced to low-severity findings only.
• Full dependency graph audit is reduced to low-severity findings only.
• Lockfile sources remain npm registry only and all resolved packages keep integrity metadata.

External actions still required

• Rotate and revoke the Firebase service account key that appeared in historical .env.admin.dev.
• Verify Vercel Preview does not receive production Firebase/ImageKit/Mercado Pago secrets.
• Confirm only the intended Vercel project deploys production from main.

Validation

• npm ci
• npm run build
• npm run check:vercel-functions
• npm run audit:prod
• npm run audit:all
• Parsed GitHub Actions and Dependabot YAML.
• Checked lockfile for non-registry sources and missing integrity metadata.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
mutter-games-admin-api	Ready	Preview, Comment	May 13, 2026 1:50pm
mutter-games-admin-api-prod	Ready	Preview, Comment	May 13, 2026 1:50pm