fix: patch Trivy CRITICAL/HIGH findings in container image

- apk upgrade in runtime stage to fix OpenSSL CVEs (CVE-2025-15467 CRITICAL, CVE-2025-69419 HIGH)
- remove npm from runtime image to eliminate npm-bundled CVEs
- update fastify to 5.8.5 and force via pnpm override (CVE-2026-33806 HIGH)
- switch vitest pool to threads to fix flaky audio extractor tests
- simplify unit test setup with direct instantiation

package.json

@@ -62,6 +62,9 @@
     ]
   },
   "pnpm": {
+    "overrides": {
+      "fastify": "^5.8.5"
+    },
     "onlyBuiltDependencies": [
       "@nestjs/core",
       "@parcel/watcher",