chore(deps): Bump the docker-minor-and-patch group across 1 directory with 2 updates

[dependabot]

Bumps the docker-minor-and-patch group with 2 updates in the /docker directory: golang and alpine.

Updates golang from 1.25.12-alpine to 1.26.5-alpine

Updates alpine from 3.21 to 3.24

[thinkbig1979]

Holding this one rather than merging it with the rest of the wave. It bundles two changes with quite different risk, and one of them conflicts with a documented invariant.

golang:1.25.12-alpine → golang:1.26.5-alpine

This breaks the Go toolchain lockstep that agent-os-vkr established: backend/go.mod carries go 1.25.0 and toolchain go1.25.12, and docker/Dockerfile's builder image is meant to match it. backend.yml's header and the docker/Dockerfile entry in its (former) path filter both exist to protect that pairing.

The practical effect is not a broken build — with GOTOOLCHAIN=auto, a 1.26.5 builder reading toolchain go1.25.12 will download and re-exec into 1.25.12, so the shipped binary is still compiled with the pinned toolchain. But that makes the bump worse than useless: it adds a toolchain download to every image build, over the network, while changing nothing about the output. And it quietly puts the two pins out of step, which is the thing the lockstep exists to prevent.

Moving to Go 1.26 is a real decision — it should change go.mod's toolchain directive and the Dockerfile together, in one reviewed change, not arrive as a side effect of a base-image group bump.

alpine:3.21 → alpine:3.24

Three releases in one step on the runtime base. agent-os-o9l's Trivy baseline established that alpine 3.21.7 contributes zero findings to the image — the entire fixable HIGH/CRITICAL surface was in the restic and rclone binaries, which agent-os-9e1 has now cleared. So there is no security pressure behind this bump, and it changes the package set underneath restic, rclone, the docker CLI plugins and the entrypoint's su-exec/shadow usage.

That is mergeable, but it wants the same treatment agent-os-9e1 just got: build the image, exercise a real backup and restore against it, then merge. Not a look-at-CI-and-merge change.

Suggested split

1. Take the alpine bump on its own, with a rebuilt-image drill.
2. Handle Go 1.26 as a deliberate toolchain upgrade that moves go.mod and the Dockerfile in lockstep.

Leaving this PR open pending that decision.