[indietyp]

🌟 Purpose

Update the Rust and Python TLS dependencies and the CA certificates bundled with uv. Keep the development-tool and container versions of uv aligned.

[cursor]

PR Summary

Medium Risk
Changes how the container validates TLS for all Node HTTPS traffic; misconfiguration could break outbound connections or leave trust policy wrong until the image is rebuilt.

Overview
Hardens TLS trust for the Node production container by switching from node:22-slim to node:22-bookworm-slim and sharing a common base stage for both build and runtime images.

The base stage installs Debian ca-certificates and fails the image build if the package is older than 20250419~deb12u2, so compromised or stale CA bundles are not silently shipped. NODE_OPTIONS=--use-openssl-ca makes Node use the system trust store instead of its bundled roots (per nodejs/node#66871) until upstream Node drops the affected intermediates.

Build and final stages now FROM base instead of repeating a bare Node image, so both npm ci / npm run build and the runtime node server/server.js process share the same CA setup.

^{Reviewed by Cursor Bugbot for commit 04dd6d9. Bugbot is set up for automated code reviews on this repo. Configure here.}