fix(security): comprehensive security audit and hardening

Auth: login rate limit 30/min (was 500), global rate limit 1000/min (was
unlimited), password/username max lengths on all Zod schemas, session
invalidation on role change, API key legacy scan bounded to 100 keys.

SVG: hardened regex sanitizer with CDATA stripping, XML entity decoding,
set/animate/iframe/embed blocking, comprehensive data: URI blocking,
use element external href blocking. 11 attack payload fixtures added.

SSRF: fixed DNS rebinding TOCTOU by pinning resolved IPs via custom
HTTP/HTTPS agents. Added 6to4 and NAT64 to blocked IPv6 ranges.

Docker: capability dropping (cap_drop ALL + minimal cap_add), resource
limits (4g/8g mem, 512/1024 pids), healthcheck timeout, password
removed from startup banner, default password warning comments.

Network: CSP and HSTS applied in all environments (not just production),
stack traces removed from all error responses, internal paths stripped
from error details, per-route rate limits on uploads (60/min) and URL
fetches (200/hour).

Files: exclusive temp file creation (O_EXCL), disk space circuit
breaker, per-user storage quotas, settings payload 64KB size guard.

Python sidecar: script name allowlist in dispatcher, minimal environment
for subprocess spawns.

Dependencies: fixed 6 production CVEs (drizzle-orm, fastify, fast-uri,
@fastify/static, next, archiver/lodash). Pinned all GitHub Actions to
SHA hashes.

114 security tests added. Full OWASP Top 10 penetration test matrix
verified against production Docker container (30/30 pass after
hardening).

apps/api/package.json

@@ -15,19 +15,19 @@
     "@fastify/cors": "^11.0.0",
     "@fastify/multipart": "^9.0.0",
     "@fastify/rate-limit": "^10.2.0",
-    "@fastify/static": "^8.1.0",
+    "@fastify/static": "^9.1.0",
     "@neplex/vectorizer": "^0.0.5",
     "@scalar/fastify-api-reference": "^1.49.5",
     "@sentry/node": "^10.49.0",
     "@snapotter/ai": "workspace:*",
     "@snapotter/image-engine": "workspace:*",
     "@snapotter/shared": "workspace:*",
-    "archiver": "^7.0.1",
+    "archiver": "^8.0.0",
     "better-sqlite3": "^11.7.0",
     "dotenv": "^16.4.0",
-    "drizzle-orm": "^0.38.0",
+    "drizzle-orm": "^0.45.2",
     "exif-reader": "^2.0.3",
-    "fastify": "^5.2.0",
+    "fastify": "^5.8.5",
     "fflate": "^0.8.2",
     "js-yaml": "^4.1.1",
     "mupdf": "^1.27.0",
@@ -52,7 +52,7 @@
     "@types/pdfkit": "^0.17.5",
     "@types/potrace": "^2.1.5",
     "@types/qrcode": "^1.5.6",
-    "drizzle-kit": "^0.30.0",
+    "drizzle-kit": "^0.31.0",
     "typescript": "^5.7.0"
   },
   "license": "AGPL-3.0"