The web image shipped starlette 0.41.3 (three HIGH: CVE-2025-62727,
CVE-2026-48818, CVE-2026-54283). FastAPI 0.146.0 / starlette 1.9.0 /
uvicorn 0.54.0 fix them; Trivy finds 0 HIGH/CRITICAL in the rebuilt image.

Regression check: the backend replayed against recorded Kubernetes and
Prometheus answers (frozen clock, writes logged not executed) gives the
same 73 responses with the old and new dependencies, 0 differences.
The image starts read-only as UID 10001 with the same headers.

CI: gitleaks over the whole history on every pipeline (verified to fail
on a planted token), Trivy on the three pushed images before deploy.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>