e6e9e11b18
- Added `min-release-age=1` to backend/.npmrc to require packages to be at least 1 day old - GitHub Actions backend jobs already use `npm ci` in backend/ directory, automatically enforcing the policy - Updated README.md with supply-chain protection policy and operational procedures BREAKING CHANGE: npm install/npm ci will now fail for packages younger than 1 day unless policy is temporarily overridden