…SBOM

- Dockerfile: bump from node:20-alpine (EOL) to node:22-alpine pinned to
  sha256:cb15fca92530…  Dependabot's docker ecosystem will refresh this.
- docker-compose.yml: enable read_only rootfs, /tmp tmpfs, cap_drop ALL,
  no-new-privileges:true. These are starter defaults — comments explain
  how to relax them per-workload.
- cd.yml:
  - Build job emits provenance + SBOM (build-push-action native flags)
    plus an explicit anchore/sbom-action CycloneDX export.
  - actions/attest-build-provenance@v3 signs the digest and pushes the
    attestation to the registry, getting us SLSA Build L3 alignment.
  - VPS deploy IMAGE switches from tag-based (":latest" / ":${version}")
    to digest-based (@${steps.build.outputs.digest}) so the rollout pulls
    exactly the artifact we just attested.
  - permissions: + id-token:write, attestations:write (required by the
    attestation action).