Harden image and fail CI on fixable vulnerabilities, update Node 22 docker image

Dockerfile

@@ -1,4 +1,4 @@
-FROM node:22-trixie-slim@sha256:b26b04c123d9ff8ab646ceb18b9d75a1173acf64b9a401094b906d27b29338d4
+FROM node:22-trixie-slim@sha256:154ba2f4d6fec323d28e4f4bb86bba4677f1223391a1979cf521304e03a98dfa
 
 # kovi does not vendor or copy Calibre code. The container installs Debian's
 # unmodified Calibre package and calls its fetch-ebook-metadata CLI as a separate
@@ -9,6 +9,17 @@ RUN apt-get update \
  && apt-get install -y --no-install-recommends calibre ca-certificates \
  && rm -rf /var/lib/apt/lists/*
 
+# Remove npm/Corepack so their bundled dependency trees are not shipped in the
+# runtime image and flagged by image scanners.
+RUN rm -rf /usr/local/lib/node_modules/npm \
+           /usr/local/lib/node_modules/corepack \
+           /usr/local/bin/npm \
+           /usr/local/bin/npx \
+           /usr/local/bin/corepack \
+           /usr/local/bin/yarn \
+           /usr/local/bin/yarnpkg \
+           /usr/local/bin/pnpm
+
 WORKDIR /app
 COPY package.json server.mjs ./
 COPY lib ./lib