chore(deps): upgrade astro to v7 and bump runtime to node 22

- astro 5.18.1 -> 7.3.2 (fixes critical XSS/RCE advisory GHSA-j687-52p2-xcff)
- @astrojs/node 9.5.5 -> 11.1.5
- typescript pinned to 6.0.3 (astro 7's requirement is satisfied by astro
  itself; typescript 7.x is an incompatible rewrite that breaks
  @astrojs/check, so staying on the 5||6 range it still supports)
- Dockerfile and nixpacks.toml bumped from node:20 to node:22, required by
  astro v6+ (minimum supported node is 22.12.0)

Dockerfile

@@ -1,4 +1,4 @@
-FROM node:20-alpine AS builder
+FROM node:22-alpine AS builder
 
 WORKDIR /app
 
@@ -9,7 +9,7 @@ COPY . .
 RUN npm run build
 
 # ── Runtime ──────────────────────────────────────────
-FROM node:20-alpine AS runtime
+FROM node:22-alpine AS runtime
 
 WORKDIR /app