chore(deps): upgrade astro to v7 and bump runtime to node 22

- astro 5.18.1 -> 7.3.2 (fixes critical XSS/RCE advisory GHSA-j687-52p2-xcff)
- @astrojs/node 9.5.5 -> 11.1.5
- typescript pinned to 6.0.3 (astro 7's requirement is satisfied by astro
  itself; typescript 7.x is an incompatible rewrite that breaks
  @astrojs/check, so staying on the 5||6 range it still supports)
- Dockerfile and nixpacks.toml bumped from node:20 to node:22, required by
  astro v6+ (minimum supported node is 22.12.0)

package.json

@@ -12,12 +12,12 @@
   },
   "type": "module",
   "dependencies": {
-    "@astrojs/node": "^9.5.5",
-    "@astrojs/sitemap": "^3.7.3",
-    "astro": "^5.18.1"
+    "@astrojs/node": "^11.1.5",
+    "@astrojs/sitemap": "^3.7.4",
+    "astro": "^7.3.2"
   },
   "devDependencies": {
-    "@astrojs/check": "^0.9.9",
-    "typescript": "^5.9.3"
+    "@astrojs/check": "^0.9.10",
+    "typescript": "^6.0.3"
   }
 }