merge: bring master (Node 24, modern CI) into main
Merges all Node 24 migration, docker buildx CI, and workflow fixes from master.
Conflict resolution:
- Dockerfile: use master version (nginx:stable-alpine, docker buildx compatible)
instead of main version (nginx:1.27-alpine with manual TARGETPLATFORM for buildah)
- package.json: auto-merged successfully — master version (10.22.1, Node >=24)
combined with main's security overrides (pbkdf2, sha.js)
Changes brought from master:
- Node 18 → Node 24 across all workflows
- actions/checkout@v3 → @v4, actions/setup-node@v3 → @v4
- docker/build-push-action@v6 replacing redhat-actions/buildah-build
- codeql-action@v2 → @v3 in codeql-analysis.yml
- Separate npm-publish job with id-token provenance
- Weekly scheduled CI build
- codeql-analysis.yml: develop branch removed, security-extended queries
- dependabot.yml: literal assignee instead of invalid template expression
- package.json: newer deps (jimp ^1.6.0, bcryptjs ^3.0.3, @xmldom/xmldom ^0.9.3)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
8c8ba460b9