fix: remediate September 2026 security findings

[jmgasper]

Summary

• remediates all 125 open critical/high/medium Dependabot alerts inventoried on 1 September 2026 (1 critical, 55 high, 69 medium), plus newer audit advisories not yet visible in the repository alert graph
• upgrades the vulnerable Nest core and constrains transitive dependency families to patched release lines, including Axios, Handlebars, Hono, Lodash, Multer, fast-uri, js-yaml, brace expansion, and related build/runtime packages
• moves local and builder execution to Node.js 26.5.1 with pnpm 11.15.1
• replaces the production official Node base with Alpine 3.24's dynamically linked nodejs-current=26.5.1-r0, applies Alpine upgrades, runs as UID 10001, and excludes npm/pnpm from the final image
• documents the supported toolchain and hardened container runtime

Validation

• pnpm audit --json: 0 critical, high, or moderate findings (4 low findings remain outside this remediation scope)
• pnpm lint: passed
• pnpm build: passed
• full Jest run: 28/30 suites and 386/406 tests passed; the 20 SFDC failures reproduce identically on untouched origin/develop (20 failures and 183 passes in those same two suites)
• Docker build: passed with --provenance=false
• runtime: Node 26.5.1; Alpine libcrypto3/libssl3 3.5.8-r0; dynamically linked /usr/lib OpenSSL; user app UID/GID 10001; npm and pnpm absent
• local Trivy image scan with critical/high/medium severities and --ignore-unfixed: 0 findings
• GitHub code-scanning inventory before the change: 0 open critical/high/medium alerts
• ECR validation tag: reports-api-v6:september2026-security-fd6e0bb
• ECR digest: sha256:2df4106d89ad01b4cffd296df8818ce0a4613b24c5e88d1757dcb744964def6d
• Amazon Inspector: ACTIVE/SUCCESSFUL; 0 active critical, high, or medium findings

Operational notes

• The running ECS service continues to use deployed tag 374; no deployed or retained ECR tag was overwritten or deleted.
• Prisma 7.0.1 emits its upstream declared-runtime warning for Node 26 during install, but dependency installation, lint, build, and all non-baseline-failing tests complete successfully.
• Dependabot alerts are expected to close after merge and dependency-graph refresh.