Fix September 2026 security findings

[jmgasper]

Summary

• resolve all critical/high/medium dependency findings reported for the root pnpm workspace and the standalone data-migration package
• replace the permissive CORS wildcard with a documented exact-origin allowlist
• remove dynamic regex construction and harden legacy description sanitization against recursive decoding and incomplete tag removal
• upgrade Node to 26.5.1 and harden both production images with patched Alpine 3.24 system packages, non-root UID 10001, and no package-manager tooling

Findings addressed

• Dependabot: #332, #330, #329, #328, #327, #326, #324, #323, #321, #317
• Code scanning: #779, #774, #773, #771, #763, #616, #615, #614

Validation

• root pnpm audit --audit-level=moderate: zero findings
• root pnpm lint and pnpm build: pass
• external-client focused tests: 3/3 pass
• data migration npm audit --audit-level=moderate, lint, and build: pass
• data migration focused security tests: 10/10 pass
• data migration full suite: 18/20 suites and 110/111 tests pass; the remaining baseline path cannot generate the checked-in Prisma schema because its datasource URL is incompatible with the package baseline Prisma 7 configuration
• mock API audit, lint, and build: pass
• main and mock Docker images: build successfully and run as UID 10001 on Node 26.5.1 with OpenSSL 3.5.8-r0 and no npm/pnpm tooling
• local Trivy scans of both images, including unfixed critical/high/medium findings: zero
• hosted CodeQL and Trivy checks: all pass; branch-scoped code scanning has zero open critical/high/medium findings

ECR candidate

• tag: september2026-security-4032916
• digest: sha256:e99153ffa169cc6303200eae20ee85a32a96139193f4cd7383e7218939afb40e
• Inspector: ACTIVE / SUCCESSFUL, zero active critical/high/medium findings
• deployed tag 534 was not changed

Environment-limited test coverage

The full API integration suite requires a reachable PostgreSQL service. With a placeholder DATABASE_URL, 82 database-dependent assertions fail during connection/setup; lint, compilation, the isolated security tests, and image checks complete successfully.

Deployment note

CORS_ALLOWED_ORIGINS accepts a comma-separated list of exact HTTPS origins (HTTP is accepted only for localhost development). The documented Topcoder production/development origins are used by default.