v1.2.4 - The project is now Gardik, and the published image is clean

Two things ship here. The project changes name, and the published image stops
carrying a vulnerability that v1.2.3 claimed to have fixed.

This release moves the repository and the Docker image. The old locations
receive nothing further.

	Before	Now
Repository	WhiteMuush/DataShield	WhiteMuush/Gardik
Image	whitemuush/datashield	whitemuush/gardik
Package	datashield	gardik

Read Upgrading before pulling. The container, volume and database names all
change, so a naive update starts on an empty database.

Security

The published image shipped mysql2@3.15.3, still carrying
GHSA-3f6p-5ww8-9rcr, the auth plugin downgrade to mysql_clear_password that
leaks the connection credentials in plaintext. That is the advisory v1.2.3
announced as fixed. It was fixed in the application, not in the image.

The cause sits in the migrator stage of the Dockerfile, which built its own
npm tree from the empty manifest npm init -y produces. The project overrides
never reached it, and npm audit could not see it either, because it reads the
application lockfile rather than the image. The overrides block is now carried
into that tree, so the two stay in sync without a second list to maintain.

Five more high-severity advisories clear with it: deepmerge-ts at 7.1.5, plus
brace-expansion, tar and ip-address, which came bundled inside npm itself.
npm is now removed from the final image, where nothing used it: the entrypoint
resolves the Prisma bundle with node, the CMD is node server.js, and so is
the healthcheck.

Every image pulled since 2 September is affected. Drop it and pull
whitemuush/gardik instead.

CI

The publish job now builds the image locally, has Trivy scan it, and pushes only
once the scan passes. Scanning after the push would have done nothing but
confirm that a vulnerable image was already public.

Upgrading

The rename reaches the infrastructure names. The volume becomes
gardik-db-data and the database gardik, both new and empty on first start.

To keep existing data, either hold the old names through POSTGRES_DB and an
explicit volumes entry, or pg_dump from the old volume and restore into the
new one before migrations run.

Seed and fixture addresses move from @datashield.local to @gardik.local.