fix(docker): drop bundled npm from runtime image to clear base-image CVEs

The runner stage ships the npm CLI bundled in node:22-alpine, whose
vendored dependencies carry known vulnerabilities that trivy flags on the
published postgresql-latest image:

  usr/local/lib/node_modules/npm/node_modules/...
    - sigstore 3.1.0        CVE-2026-48815 (HIGH)
    - picomatch 4.0.3       CVE-2026-33671 (HIGH)
    - @sigstore/core 2.0.0  CVE-2026-48758
    - brace-expansion 2.0.2 CVE-2026-33750
    - ip-address 10.1.0     CVE-2026-42338
    - tar 7.5.11            CVE-2026-53655

npm is only a build-time bootstrap for pnpm; it is not needed at runtime.
Install pnpm with it, then remove npm in the same layer so none of these
vendored packages are present in the final image, and run the container
via pnpm instead of npm. pnpm (and corepack) remain and were never flagged.

The curl/libcurl/c-ares HIGH findings are resolved by rebuilding alone,
since Alpine 3.24 already serves curl 8.21.0-r0 / c-ares 1.34.8-r0 (the
published image is simply stale).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Dockerfile

@@ -44,9 +44,13 @@ ENV NODE_OPTIONS=$NODE_OPTIONS
 
 RUN addgroup --system --gid 1001 nodejs
 RUN adduser --system --uid 1001 nextjs
+# Bootstrap pnpm with the bundled npm, then remove npm in the same layer so the
+# vulnerable packages vendored inside the npm CLI are not shipped in the final
+# image. pnpm is the only package manager needed at build and runtime.
 RUN set -x \
     && apk add --no-cache curl libc6-compat \
-    && npm install -g pnpm
+    && npm install -g pnpm \
+    && rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
 
 RUN echo {} > package.json
 
@@ -76,4 +80,4 @@ EXPOSE 3000
 ENV HOSTNAME=0.0.0.0
 ENV PORT=3000
 
-CMD ["npm", "run", "start-docker"]
+CMD ["pnpm", "run", "start-docker"]