Adds a hardened .npmrc enforcing npm supply-chain best practices:

ignore-scripts=true
strict-ssl=true
save-exact=true
# engine-strict=true  (disabled — see notes)
legacy-peer-deps=false
audit-level=high

Notes:

• ignore-scripts=true skips Cypress's postinstall binary download. Cloud runs via browserstack-cypress are unaffected; for local Cypress runs, execute npx cypress install once after npm install.
• engine-strict is commented out because the serialize-javascript override requires Node >=20 while this sample supports Node 18; it can be enabled once that floor changes.
• Verified: npm ci against the committed package-lock.json on Node 18, 20, and 22 — lockfile unchanged; sample test run verified.

🤖 Generated with Claude Code