fix(security): remediate September 2026 findings

[jmgasper]

Summary

• resolve all open critical/high/medium dependency alerts with patched lockfile resolutions, including the Inspector-required fast-uri 4.1.2
• prevent environment-derived Kafka topics, raw client errors, and stack traces from reaching event-publication logs while retaining safe operation/failure diagnostics
• update the runtime to Node 26.5.1 on Alpine 3.24 with system OpenSSL 3.5.8, a non-root UID, and no package tooling

Validation

• pnpm audit: no known vulnerabilities
• pnpm lint: passed
• pnpm build: passed
• targeted project/logger tests: 2 suites, 41 tests passed
• full unit suite: 49/60 suites and 380/395 tests passed; the 10 stale event-publish mock assertions and 5 JWT fixture assertions already documented on dev remain unchanged
• production Docker build and runtime inspection: Node 26.5.1, OpenSSL 3.5.8-r0, dynamic system SSL linkage, UID/GID 10001, npm absent
• Trivy 0.72.0 critical/high/medium scan: zero findings
• GitHub CodeQL, Actions analysis, and Trivy PR checks: passed; branch has zero open critical/high/medium code-scanning alerts
• AWS Inspector candidate september2026-security-ca17fa5-amd64: scan successful, zero active critical/high/medium findings (no deployed tag overwritten)

Closes the remediation for Dependabot alerts #214-#222, Trivy alerts #107-#112, and CodeQL alert #8.