ENG-0000 chore: patch Node.js async_hooks DoS (Jan 2026)

[jonathanprozzi]

Updates Node.js runtime pins and engine constraints to patched minors for the January 2026 async_hooks DoS vulnerability.

Notes:

• Uses the repo's existing major version to infer the patched minor.
• For EOL majors (<20), bumps to Node 20.20.0.

Changes:

• package.json: engine -> >=20.20.0 <21.0.0

Why this fixes the issue:

• engines.node is a guard rail only; it does not change the runtime.
• Runtime pins (.nvmrc, Dockerfile, CI node-version, hosting config) control what Node actually runs.
• Deploy/rebuild is required to apply the patched runtime in production.
• Dependency updates (react/next/etc.) are for compatibility only; they do not patch Node itself.

Extra notes:

• Floating Docker tags (e.g., node:20-alpine) require a rebuild or pin to the patched minor.