[kwsantiago]

Removes the package managers that node:22-alpine bundles from the frontend runtime image, and adds the frontend to the container scan, which until now scanned only the backend.

The runtime image carried npm, npx, corepack and yarn 1.22.22. None of them runs: the image starts with node server.js, and the StartOS package launches it through that entrypoint. npm's own dependencies brought 10 HIGH findings into the shipped image (brace-expansion 2.0.2, ip-address 10.1.0, pacote, picomatch 4.0.3 and sigstore 3.1.0, all under /usr/local/lib/node_modules/npm/). Deleting them in the runtime stage clears all 10. The builder stage still uses corepack and pnpm; only the runtime stage changes.

container-scan is now a summary of a matrix job, image-scan, that builds and scans the backend and frontend images separately. The deployment gate in docs/security/production-deployment-gate.md requires a check named container-scan, so the summary keeps that name and fails unless every image scan passed.

Verified locally, building with NEXT_PUBLIC_CANARY_MODE=self-hosted as the StartOS package does, and comparing against an image built from master: /, /login and /wallets redirect to /sign-in with 307 on both, /sign-in returns 200 at an identical 91,628 bytes with the same static assets, and neither logs a server error. npm, npx, corepack, yarn and yarnpkg are absent and node runs as nextjs. Trivy on the new image, with the CI settings: 0 CRITICAL or HIGH across the Alpine and Node packages it inventories.