fix: patch Trivy CRITICAL/HIGH findings in container image

- apk upgrade in runtime stage to fix OpenSSL CVEs (CVE-2025-15467 CRITICAL, CVE-2025-69419 HIGH)
- remove npm from runtime image to eliminate npm-bundled CVEs
- update fastify to 5.8.5 and force via pnpm override (CVE-2026-33806 HIGH)
- switch vitest pool to threads to fix flaky audio extractor tests
- simplify unit test setup with direct instantiation

Dockerfile

@@ -37,6 +37,9 @@ RUN mkdir -p /deploy/migrations && cp -r /app/server/src/db/migrations/. /deploy
 FROM ${NODE_IMAGE} AS runtime
 WORKDIR /app
 
+RUN apk upgrade --no-cache && \
+    rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
+
 ENV NODE_ENV=production
 ENV PORT=3000