Merge origin/main into ci/test-coverage; resolve package-lock conflict

Regenerated package-lock.json from the merged package.json so both the
main-side deps (pino, LICENSE) and this branch's @vitest/coverage-v8 are
reconciled. 91 unit tests pass; coverage gate passes above thresholds.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: dobby-coder[bot]

.env.example

@@ -3,6 +3,11 @@ PUBLIC_SITE_URL=http://localhost:5173
 
 # Database
 DATABASE_URL="postgres://user:password@localhost:5432/postguard_business"
+# Optional connection-pool tuning (postgres.js). Defaults are used if unset.
+# DB_POOL_MAX=10            # max pooled connections
+# DB_IDLE_TIMEOUT=20        # seconds before an idle connection is closed
+# DB_CONNECT_TIMEOUT=10     # seconds to wait when opening a connection
+# DB_MAX_LIFETIME=1800      # seconds before a connection is recycled
 
 # Yivi (YIVI_SERVER_URL and YIVI_SERVER_TOKEN set in docker-compose / k8s)
 YIVI_DEMO_ATTRIBUTES=true

LICENSE

@@ -0,0 +1,19 @@
+Copyright 2021 Encryption 4 All
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+of the Software, and to permit persons to whom the Software is furnished to do
+so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -323,3 +323,7 @@ Internet → Ingress → business-svc:3000 → business-deployment
 ```
 
 The IRMA/Yivi server is accessed through SvelteKit's backend proxy (`/irma/[...path]`), which adds the authentication token. The browser never communicates directly with the IRMA server.
+
+## License
+
+[MIT](LICENSE) © Encryption 4 All