fix: CVE vulnerabilities in npm bundled dependencies inside Docker images

[dzhhem]

Describe the bug
Docker images built from apps/api, apps/bot, and apps/web Dockerfiles contain vulnerable npm-bundled dependencies detected by Trivy SAST scan. The vulnerabilities reside in npm's own internal dependencies at usr/local/lib/node_modules/npm/node_modules/, not in project dependencies managed by pnpm.

Reproduction Steps

1. Build any of the three Docker images from the repo
2. Run trivy image <image-name>
3. See HIGH/MEDIUM CVEs under usr/local/lib/node_modules/npm/node_modules/

Expected behavior
No HIGH/MEDIUM CVEs in built Docker images.

Screenshots
See GitHub Security → Code scanning alerts.

Environment Details (please complete the following information):

• OS: Linux (CI / Docker)
• Browser: N/A
• App Component: API, Web, Bot — Docker images
• Version: node:24-alpine

Additional context

CVE	Severity	Package	Installed	Fixed
CVE-2026-33671	HIGH	picomatch	4.0.3	4.0.4
CVE-2026-33672	MEDIUM	picomatch	4.0.3	4.0.4
CVE-2026-45149	MEDIUM	brace-expansion	5.0.4	5.0.6
CVE-2026-33750	MEDIUM	brace-expansion	5.0.4	5.0.5
CVE-2026-42338	MEDIUM	ip-address	10.1.0	10.1.1