security(deps): resolve container scan findings

Upgrade fixable Node dependencies and rebuild the pinned kepubify binaries with Go 1.27.3 so multi-architecture image publication passes the security gate.

server/package.json

@@ -106,9 +106,9 @@
     "rxjs": "^7.8.2",
     "sharp": "^0.35.5",
     "socket.io": "^4.8.4",
-    "undici": "^8.11.2",
+    "undici": "^8.12.2",
     "unzipper": "^0.12.5",
-    "zod": "^4.6.5"
+    "zod": "^4.6.6"
   },
   "devDependencies": {
     "@eslint/eslintrc": "^3.3.7",