fix(docker): use Node 22.14 + corepack via packageManager field

Dockerfile

@@ -1,12 +1,17 @@
-# Frontend build stage - use slim (Debian) for better native module compatibility.
-# Pin to a specific patch tag; the frontend gets compiled into the binary, so a
-# silently-rolled Node minor would change shipped artifacts without any code change.
-FROM node:22.12.0-slim AS frontend
+# Frontend build stage. Track the active Node 24 LTS (Jod) line so security
+# patches flow through; the major is pinned so we control any cross-version
+# bumps. Node 25 unbundled corepack, so staying on 24 LTS lets us keep the
+# clean `corepack enable` install path below — actual pnpm version comes from
+# the `packageManager` field in package.json (with integrity hash).
+FROM node:24-slim AS frontend
 
 WORKDIR /app/web
 
-# Install pnpm
-RUN corepack enable && corepack prepare pnpm@latest --activate
+# `corepack enable` is enough — when `pnpm install` runs below, corepack reads
+# the `packageManager` field from package.json and pulls that exact pnpm
+# version (with integrity hash). Avoids `pnpm@latest` floating to a version
+# that doesn't match local dev.
+RUN corepack enable
 
 # Install dependencies
 COPY web/package.json web/pnpm-lock.yaml ./