[ABilenduke]

Closes #5

What changed

• docs/adr/0001-node-runtime-and-npm.md: Node.js LTS in every JavaScript repository, with the bundled npm hardened in .npmrc (strict-allow-scripts, min-release-age=7, allow-git=none, allow-remote=none, engine-strict) and installed with npm ci (DE-2).
• docs/adr/0002-container-baseline.md: distroless nonroot runtime images (nginx-unprivileged for the static SPAs), digest-pinned. Every service runs as a numeric non-root user, with an exec-form CMD, a shell-free HEALTHCHECK, init, a read-only root plus a /tmp tmpfs, cap_drop: ALL and no-new-privileges (DE-5).
• README.md: all eight local addresses (DE-11); the local services named, with Valkey (Redis-compatible) (DE-12); links to the ADRs.

Requirements covered

Requirement	Evidence
ADR 0001 and 0002 with context, decision, alternatives and consequences, citing commerce#3	The two files; each cites RQ-1 or RQ-4 and DE-2 or DE-5
The README lists 8 hosts and names Valkey	The address table; "Local versus production"
No contradiction with the platform's ADR 0001 or commerce#3	ADR 0002 points to the platform ADR for the infrastructure containers; every claim is taken from the commerce#3 findings

Verification

Read against commerce#3's decisions (DE-2, DE-5, DE-11, DE-12) and research findings F1-F12 and F44-F52. Two draft claims went beyond the evidence and were narrowed before committing:

• an exact pin bypassing npm's release-age window (only pnpm's window was tested);
• how each service's health check works (left to each application's ADR).

Risk and rollback

Docs only. Revert the commit.