Remediate dev-tool advisories and remove unnecessary tooling from runtime images #185

Follow-up to #156/#157; source 385e7679fabc60b80cd65cf0a1aa4cdf3d592514, reviewed 2026-10-23. The security inventory records bounded evidence, not deployed-site clearance.

Priority: P2; P1 when a vulnerable dev/test server is exposed. Use separate compatible toolchain and runtime-packaging PRs.

Evidence: the final lock contains Vite 5.4.21, Vitest/coverage 1.6.1 and tinypool 0.8.4. The dated full audit has 17 package entries (3 critical,1 high,11 moderate,2 low); production-only audit has eight moderate. These include inherited findings, not distinct exploits. Vite binds all interfaces. Vite has OS/network prerequisites; Vitest UI requires UI/API/browser-mode conditions; tinypool requires a prototype-pollution prerequisite. Configured tests use vitest --run; no live exposure was established.

The API Dockerfile installs full dependencies and the generic Dockerfile copies them into runtime. A dev dependency can therefore be present without being loaded by the API. Final build/startup checks are not full-image vulnerability clearance.

Reproduce the inventory using the pinned lock, timestamped npm audit --json and npm ls vite vitest @vitest/coverage-v8 tinypool esbuild; inspect actual built-image package resolution read-only. Audit metadata can change independently of source.

Acceptance criteria:

• Upgrade Vite/Vitest/plugin/coverage/worker dependencies together to officially patched compatible versions; verify all affected paths. Do not replace a worker major under Vitest 1 or apply blanket forced upgrades without compatibility evidence.
• Validate Node 22.18/24 suites, coverage, mocks/timers, reporters, worker cleanup, strict evidence rejection, dev proxy/HMR/offline shell and browser gates. Record discovery changes without relaxing skips/flaky/timeout checks.
• Keep development access intentional; document supported exposure/OS limits. Retain lower-priority Turbo and Mermaid/KaTeX findings in the tooling backlog as separate scoped updates.
• Packaging PR: exclude unused build/test/dev tools from both runtime images while preserving workspace/native dependencies; prove clean build, production startup, secret rejection, API behavior and compiled MCP stdio contracts.
• Inventory actual final image digests and OS/npm findings with scanner/database versions; distinguish present packages from loaded surfaces and retain residual findings.

Moving declarations or passing startup does not eliminate vulnerable code or establish full image security. No deployment or credential expansion is part of this issue.