chore(deps): upgrade astro to v7 and bump runtime to node 22

- astro 5.18.1 -> 7.3.2 (fixes critical XSS/RCE advisory GHSA-j687-52p2-xcff)
- @astrojs/node 9.5.5 -> 11.1.5
- typescript pinned to 6.0.3 (astro 7's requirement is satisfied by astro
  itself; typescript 7.x is an incompatible rewrite that breaks
  @astrojs/check, so staying on the 5||6 range it still supports)
- Dockerfile and nixpacks.toml bumped from node:20 to node:22, required by
  astro v6+ (minimum supported node is 22.12.0)

Dockerfile

@@ -1,4 +1,4 @@
-FROM node:20-alpine AS builder
+FROM node:22-alpine AS builder
 
 WORKDIR /app
 
@@ -9,7 +9,7 @@ COPY . .
 RUN npm run build
 
 # ── Runtime ──────────────────────────────────────────
-FROM node:20-alpine AS runtime
+FROM node:22-alpine AS runtime
 
 WORKDIR /app
 

nixpacks.toml

@@ -4,7 +4,7 @@ HOST = "0.0.0.0"
 PORT = "4321"
 
 [phases.setup]
-nixPkgs = ["nodejs_20"]
+nixPkgs = ["nodejs_22"]
 
 [start]
 cmd = "node ./dist/server/entry.mjs"

package.json

@@ -12,12 +12,12 @@
   },
   "type": "module",
   "dependencies": {
-    "@astrojs/node": "^9.5.5",
+    "@astrojs/node": "^11.1.5",
-    "@astrojs/sitemap": "^3.7.3",
+    "@astrojs/sitemap": "^3.7.4",
-    "astro": "^5.18.1"
+    "astro": "^7.3.2"
   },
   "devDependencies": {
-    "@astrojs/check": "^0.9.9",
+    "@astrojs/check": "^0.9.10",
-    "typescript": "^5.9.3"
+    "typescript": "^6.0.3"
   }
 }