fix(docker): resolve 4 CVEs in production image

Remove npm/npx from runner stage and upgrade Alpine packages to
patch minimatch, tar, busybox, and zlib vulnerabilities.

Dockerfile

@@ -18,7 +18,10 @@ LABEL org.opencontainers.image.vendor="root.cloud"
 WORKDIR /app
 ENV NODE_ENV=production
 ENV NEXT_TELEMETRY_DISABLED=1
-RUN addgroup --system --gid 1001 nodejs && \
+RUN apk upgrade --no-cache && \
+    npm uninstall -g npm && \
+    rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npx && \
+    addgroup --system --gid 1001 nodejs && \
     adduser --system --uid 1001 nextjs
 COPY --from=builder /app/public ./public
 COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./

ROADMAP.md

@@ -232,6 +232,7 @@ This document tracks the development status and planned features for JMAP Webmai
 - [x] Structured server-side logger (text/JSON format, configurable level)
 - [x] Pre-built Docker image on [Docker Hub](https://hub.docker.com/r/rootfr/jmap-webmail) and [GHCR](https://ghcr.io/root-fr/jmap-webmail) with multi-arch support (amd64/arm64)
 - [x] GitHub Actions CI/CD for automated image publishing on releases
+- [x] CVE remediation: remove npm from production image, upgrade Alpine packages
 
 ## Planned Features