remediate

• Base image — bump and rebuild 2026-04-25
• SAST finding — triage and fix 2026-04-25
• OWASP Top 10 (2026) — remediate 2026-04-22
• OWASP Top 10:2025 — remediate 2026-04-22