Remediate September 2026 security findings

[jmgasper]

Summary

• upgrade all dependency versions implicated by the open critical/high/medium Dependabot and lockfile scanning alerts
• replace modulo-biased deletion identifiers with uniform crypto.randomInt selection and focused tests
• decode legacy HTML entities in one pass so nested entity text cannot be decoded twice across the response trust boundary
• move development and build tooling to Node 26.5.1 and refresh the pinned Chainguard runtime
• run the final container as UID 65532 with only the Node executable; shell, npm, pnpm, node-gyp, Git, and package managers are absent

Security coverage

• Dependabot: brace-expansion, deepmerge-ts, fast-uri, hono, js-yaml, and valibot upgraded to patched releases
• CodeQL 227: biased cryptographic random selection removed
• CodeQL 228: double HTML entity decoding removed
• ECR: refreshed Wolfi packages and patched production dependency graph replace the 16 current critical/high/medium findings on the deployed digest

Verification

• pnpm audit --audit-level=moderate: no known vulnerabilities
• pnpm lint: passed
• pnpm build: passed
• focused security and StatisticsService tests: 47 passing
• full pnpm test: 228 passing; 22 local integration/harness failures remain because the standalone test database lacks the standardized-skills members.user_skill schema, AUTH0_URL bus configuration, and several legacy validation expectations
• production Docker build: passed
• runtime inspection: UID/GID 65532, Node 26.8.1 patched runtime, only /usr/bin/node present
• Prisma CLI smoke test in the stripped runtime: passed
• Trivy critical/high/medium image scan with fixed vulnerabilities: zero findings
• Amazon Inspector continuous scan of member-api-v6:september2026-security-scan-20260901: SUCCESSFUL, zero critical/high/medium findings