fix: update Next and harden the standalone runtime image

Upgrade Next and eslint-config-next to 16.4.1; build and run on the same pinned Alpine Node image, exclude pnpm cache from context, and omit build-only package managers from production.

Co-Authored-By: Codex <noreply@openai.com>

.dockerignore

@@ -6,3 +6,5 @@ playwright-report
 coverage
 .env*
 *.log
+
+.pnpm-store

docker/quickstart/Dockerfile

@@ -1,4 +1,4 @@
-FROM registry-1.docker.io/library/node:22-bookworm-slim AS frontend
+FROM registry-1.docker.io/library/node:22-alpine@sha256:fe4f6d74e20370acb04ad889077d14d0f64a9c8ea6a42bc60cddf1e844699914 AS frontend
 WORKDIR /app
 ENV NEXT_TELEMETRY_DISABLED=1
 RUN corepack enable && corepack prepare pnpm@9.15.9 --activate
@@ -9,8 +9,12 @@ ENV QQQ_BACKEND_URL=http://host.docker.internal:8000
 ENV NEXT_PUBLIC_MOCK_API=false
 RUN pnpm build
 
-FROM registry-1.docker.io/library/node:22-bookworm-slim AS runtime
+FROM registry-1.docker.io/library/node:22-alpine@sha256:fe4f6d74e20370acb04ad889077d14d0f64a9c8ea6a42bc60cddf1e844699914 AS runtime
 LABEL org.opencontainers.image.source="https://github.com/QRun-IO/qqq-frontend-next"
+# Standalone production starts node directly; package managers are build-only.
+RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/lib/node_modules/corepack /opt/yarn-* \
+    && rm -f /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack \
+       /usr/local/bin/pnpm /usr/local/bin/pnpx /usr/local/bin/yarn /usr/local/bin/yarnpkg
 WORKDIR /app
 ENV NODE_ENV=production NEXT_TELEMETRY_DISABLED=1 HOSTNAME=0.0.0.0 PORT=3000
 COPY --from=frontend --chown=node:node /app/.next/standalone ./

package.json

@@ -57,7 +57,7 @@
     "dompurify": "^3.4.16",
     "lodash": "^4.18.1",
     "lucide-react": "^0.485.0",
-    "next": "16.3.8",
+    "next": "16.4.1",
     "rapidoc": "10.1.0",
     "react": "^19.2.4",
     "react-dom": "^19.2.4",
@@ -93,7 +93,7 @@
     "@vitest/ui": "^4.1.11",
     "autoprefixer": "^10.4.27",
     "eslint": "^9.39.3",
-    "eslint-config-next": "16.3.6",
+    "eslint-config-next": "16.4.1",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-jsdoc": "^62.7.1",
     "jest-axe": "^10.0.0",