fix(security): resolve Docker image CVEs for code scanning alerts

- Upgrade nginx base from 1.27-alpine to 1.28-alpine (Alpine 3.23, OpenSSL 3.5.5)
- Upgrade npm to latest in backend production stage to fix tar, minimatch, brace-expansion CVEs
- Add brace-expansion and minimatch overrides for app-level transitive deps
- Remove incompatible body-parser v2 override (breaks Express 4 JSON parsing)
- Remove npm upgrade from builder stages (npm 11 breaks npm ci with existing lockfile)

backend/package.json

@@ -66,10 +66,11 @@
       "tar-fs": "2.1.4"
     },
     "glob": "^11.1.0",
-    "body-parser": "^2.2.1",
     "js-yaml": "^4.1.1",
     "fast-xml-parser": ">=5.3.8",
     "qs": ">=6.14.2",
-    "tar": ">=7.5.8"
+    "tar": ">=7.5.8",
+    "brace-expansion": ">=5.0.0",
+    "minimatch": ">=9.0.7"
   }
 }