Remediate September 2026 security findings

[jmgasper]

Summary

• close critical CodeQL SSRF alerts #138 and #139 by routing outbound traffic through named, configuration-backed endpoints, rejecting unsafe path components, and disabling redirects
• upgrade all open high/medium Dependabot packages in the pnpm and migrator npm lockfiles, including every safe brace-expansion line
• move the production image to Alpine 3.24 with dynamically linked Node 26.5.1, OpenSSL 3.5.8, a numeric non-root user, and no npm/pnpm/git tooling
• keep Node native promises so Axios 1.18 can use standard Promise.withResolvers

Validation

• pnpm lint — passed
• pnpm build — passed
• pnpm audit --audit-level=moderate — no known vulnerabilities
• migrator npm audit --audit-level=moderate — no known vulnerabilities
• outbound URL security regression suite — 12 passing
• Docker production build — passed; UID/GID 10001, Node 26.5.1, nodejs-current-26.5.1-r0, libcrypto3/libssl3-3.5.8-r0, system OpenSSL linkage, and no npm/pnpm/git
• Trivy image scan with fixed critical/high/medium findings — 0 vulnerabilities
• AWS Inspector continuous scan of unique dev ECR tag september2026-security-validation-cd2ae84 — successful, 0 active critical/high/medium findings
• GitHub CodeQL and Trivy PR checks — passed

Existing test limitations

• the full root suite reaches 71 passing tests but retains 106 failures from existing assertion-path expectations and missing challenge/member fixtures; the new security tests all pass
• the migrator has no lint or build script; its four existing Jest suites remain broken by their current exports/log-directory setup after Prisma generation

[jmgasper]

Follow-up remediation verification: commit 48be080 removes all eight PR-scoped jwt-token findings from the exported Postman environment, documents local token injection, and leaves the collection valid. Hosted CodeQL/Trivy checks are green and the PR-scoped critical/high/medium alert query is empty. Exact candidate september2026-security-48be080 (sha256:1152264879ee26facb270816fed6e63511859933b56d020f24c2b76c575741a2) is Inspector ACTIVE / SUCCESSFUL with zero active critical, high, or medium findings; existing deployed tags were not changed.