fix(security): remediate September 2026 findings

[jmgasper]

Summary

• update the development and build runtime to Node.js 26.5.1
• pin all vulnerable brace-expansion, deepmerge-ts, fast-uri, and js-yaml dependency lines to patched releases
• replace the production base with Alpine 3.24 packages for Node.js 26.5.1 and OpenSSL 3.5.8
• run the production container as the unprivileged app user and omit npm and Node.js headers
• remove committed credentials and literal JWT test fixtures, and document safe credential handling

Findings addressed

• Dependabot alerts 180, 184, 185, 187, 188, 189, and 190
• Code scanning alerts 28, 30, 31, and 32
• current dev ECR Node.js 26.5.0, OpenSSL 3.5.7, deepmerge-ts 7.1.5, js-yaml 5.2.1, and brace-expansion 1.1.16 findings

Validation

• pnpm lint
• pnpm build
• pnpm test --runInBand (24 tests)
• pnpm audit and pnpm audit --prod at moderate threshold
• clean Docker build from the frozen lockfile
• production container migrated a fresh PostgreSQL database, started as UID/GID 10001, and served Swagger with HTTP 200
• runtime inspection confirmed Node.js 26.5.1, OpenSSL 3.5.8, dynamic libcrypto/libssl linkage, and no npm binary
• Trivy 0.73.0 repository scan: zero critical/high/medium vulnerabilities, secrets, or Dockerfile misconfigurations
• Trivy 0.73.0 dev-inclusive lockfile scan: zero critical/high/medium vulnerabilities
• Trivy 0.73.0 production image scan: zero critical/high/medium vulnerabilities

[jmgasper]

ECR follow-up verification: candidate september2026-security-d3b1643-inspector (sha256:37698b008313e5a3ad6428d18acc866db5c10b03f75fb2d18c1da43d4c2fcebe) is Inspector ACTIVE / SUCCESSFUL with zero active critical, high, or medium findings. Deployed tag 47 was not changed.