fix(runtime): enforce session and environment contracts

package.json

@@ -2,6 +2,10 @@
   "name": "cozsweet-frontend-nextjs",
   "version": "0.1.0",
   "private": true,
+  "packageManager": "pnpm@10.30.3",
+  "engines": {
+    "node": "24.x"
+  },
   "scripts": {
     "dev": "next dev",
     "build": "next build",
@@ -37,7 +41,7 @@
     "@xstate/react": "^5",
     "classnames": "^2.5.1",
     "dexie": "^4.4.3",
-    "esbuild": "^0.25.0",
+    "esbuild": "^0.28.0",
     "lucide-react": "^1.18.0",
     "next": "16.2.7",
     "next-auth": "^4.24.14",
@@ -55,7 +59,7 @@
   "devDependencies": {
     "@playwright/test": "^1.61.1",
     "@tailwindcss/postcss": "^4",
-    "@types/node": "^20",
+    "@types/node": "^24",
     "@types/react": "^19",
     "@types/react-dom": "^19",
     "@vitest/coverage-v8": "^4.1.8",