chore: document Node 22 requirement

[salmonumbrella]

Summary

The backend requires Node 22: newer majors break its SSRF-safe fetch layer because Node's built-in fetch conflicts with the pinned undici dispatcher (four safeFetch tests fail on Node 26). CI already runs 22, but nothing pinned or documented it for contributors.

Changes

• engines field on backend/package.json (>=22 <23 — the verified range).
• .nvmrc with 22 at the repo root.
• README prerequisites and the Ubuntu/Debian install snippet pinned to Node 22.

Testing

• Backend suite + lint green on Node 22.20.0; doc/manifest-only change otherwise.

---

Contributor License Agreement

By submitting this pull request I confirm that:

• I have read and agree to the Contributor License Agreement.
• My contribution is my own original work (or I have identified any
  third-party material and confirmed it is compatible with the CLA).
• I have the right to submit this contribution under the terms of the CLA.