Fix npm advisories and pin dependencies by hash

[ronkq]

Stacked on #6.

• Security bumps: next 16.3.0 → 16.3.6 (critical image-optimizer RCE, GHSA-2xp9-vwfh-vxw4), sharp 0.35.4, postcss 8.5.28, js-yaml 3.15.2, fflate 0.6.11. npm audit is clean.
• Node 22.14.0 → 22.23.3 (six missed security releases).
• Docker base images pinned by digest (node, postgres, the Dockerfile syntax frontend).
• GitHub Actions pinned to commit SHAs; trufflehog moved off @main.
• Python deps compiled with hashes (requirements.in → requirements.txt, installed with --require-hashes), same for pip-audit.
• hadolint and shellcheck downloads verified by sha256.