Rebuild web image on fixed Alpine packages

Defect (`docs/compliance/risk-register.md:119`, R-SOC-31): ECR enhanced scan (`ecr-scan/2026-10-09/summary.json` in the prod evidence bucket) shows OS findings in running prod images: `web` (nginx:alpine) high findings with fixed Alpine packages available; `api` 1 critical (gnutls28 CVE-2026-95210) + 8 high in Debian with no fix yet. SLA: web by 2026-11-08; api critical acceptance by 2026-10-16 if no fix. Fix: bump/pin the web base image to a digest carrying the fixed packages (or `apk upgrade` in the Dockerfile under `infra/local/`), and for `api` add `apt-get upgrade` of the affected packages if Debian has published fixes; otherwise record the dated acceptance in R-SOC-31. Out of scope: base-image family changes; application code; other images. Done means: - After dev deploy, `aws ecr describe-image-scan-findings` on the new dev web image shows no high/critical with a fix available — cite counts. - `./dc check full` green; PR merged to develop; Jaah Deploy green; R-SOC-31 updated.

Web image now runs `apk upgrade` (PR #4787 merged, full gate green, Jaah Deploy 37977941545 green). New dev web image 53da684310 scans 0 findings (was 4 HIGH). api: no Debian fix yet; R-SOC-31 updated. Follow-up: the apk layer is cached per base digest.