fix: remediate September 2026 security findings

[jmgasper]

Summary\n\n- update Node and all affected transitive dependency paths for the September 2026 advisory set\n- rebuild the production stage on Alpine 3.24 with dynamically linked nodejs-current and patched system OpenSSL\n- run the final image as an unprivileged UID and exclude npm/package tooling\n- document the supported runtime and container hardening\n\n## Security findings addressed\n\n- Dependabot alerts 5-7 and 10-15: find-my-way 9.7.0, js-yaml 5.2.2/4.3.1/3.15.1, valibot 1.4.2, fast-uri 3.1.5, deepmerge-ts 8.0.0, and safe brace-expansion variants\n- Code-scanning alerts 1-6: the same patched lockfile paths\n- current ECR image findings: Node 26.5.1, Alpine OpenSSL 3.5.8, and patched application dependencies\n\n## Validation\n\n- pnpm audit --audit-level=moderate: no known vulnerabilities\n- pnpm lint: passed\n- pnpm build: passed after generating the documented Prisma/external client build inputs\n- Jest: 15 suites passed, 1 skipped, and 1 failed; 121 tests passed, 3 skipped, and 2 failed\n- the same two forums-moderation integration failures were reproduced on untouched origin/develop (4 passed and 2 failed in that baseline suite)\n- production Docker build: passed\n- runtime inspection: UID 10001, Node 26.5.1, libssl/libcrypto 3.5.8 with dynamic linkage, npm absent\n- Trivy critical/high/medium image scan with unfixed findings ignored: zero findings\n\nECR verification artifact: forums-api-v6:september2026-security-cca7ef3, digest sha256:b46776a966d672b02decafb2d3ae6170a0b33e34e531481f30b695a9daaa027a.\n\nExisting deployed and retained image digests are unchanged; their historical findings remain until the patched image is deployed and old artifacts expire or are retired.\n\nAWS Inspector completed the verification artifact scan with ACTIVE/SUCCESSFUL status and zero active critical/high/medium findings.