build: pin the builder image to Alpine 3.23

node:25-alpine currently resolves to Alpine 3.23 (the newest Alpine
with node variants); pinning makes base-OS bumps deliberate. caddy
publishes no alpine-versioned tags — 2-alpine tracks upstream and ships
3.23 today.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PQBG6D5kahSu9frv13XQ4W

Author: mightea

Dockerfile

@@ -1,4 +1,6 @@
-FROM node:25-alpine AS builder
+# Alpine 3.23 is the latest Alpine with node image variants (checked 2026-07);
+# pinned explicitly so base-OS bumps are deliberate rather than surprise rebuilds.
+FROM node:25-alpine3.23 AS builder
 ENV PNPM_HOME=/pnpm
 ENV PATH=$PNPM_HOME:$PATH
 RUN mkdir -p $PNPM_HOME && npm install -g corepack@latest --force && corepack enable && corepack prepare pnpm@10.2.1 --activate
@@ -10,6 +12,8 @@ RUN pnpm install --frozen-lockfile
 COPY . .
 RUN pnpm build
 
+# caddy publishes no alpine-versioned tags; 2-alpine tracks the latest
+# Alpine automatically (3.23 as of 2026-07).
 FROM caddy:2-alpine AS runtime
 ARG APP_VERSION=0.0.0
 ENV APP_VERSION=$APP_VERSION