[SloMR]

Summary

This moves the web and server toolchains to releases that fix published advisories. Node.js goes to the 24.22.1 security release, NGINX is pinned to 1.31.8, Angular goes to 22.2.3, and the server crates are refreshed with cargo update. Production web dependencies now report no advisories. Two stay because no fixed release exists: braces 3.0.3, which only dev tooling pulls in, and h2 0.3, which actix-http 3 still requires and which is unreachable because NGINX talks HTTP/1.1 to the server.

What changed

• The WebSocket handshake tests send a valid Sec-WebSocket-Key, since actix-http 3.19 rejects keys that aren't base64 of 16 bytes
• cargo update fixes RUSTSEC-2026-0385 in ctutils and RUSTSEC-2026-0383 in webpki-root-certs, and replaces the yanked yoke-derive 0.8.3
• Node.js is pinned to 24.22.1 in .nvmrc, CI and both Dockerfile stages
• Angular 22.2.3 fixes the SSR advisories in @angular/router and @angular/platform-server, and @angular/cli 22.2.4 brings @modelcontextprotocol/server 2.3.1
• An overrides entry forces vite 8.3.5 under @angular/build, which still pins the vulnerable 8.3.0
• follow-redirects and launch-editor move to their patched releases
• The other web dependencies are updated within their ranges, with the package.json minimums raised to match
• The NGINX image is pinned to 1.31.8-alpine-slim, since docker compose build doesn't re-pull a floating tag