fix: update node to 20.20.0-alpine

[k9ert]

Summary

• Update all Dockerfiles (realtime/Dockerfile, history/Dockerfile, history/Dockerfile-migrate) from node:20-alpine to node:20.20.0-alpine
• CVE mitigation: https://nodejs.org/en/blog/vulnerability/january-2026-dos-mitigation-async-hooks

Resolves blinkbitcoin/blink-wip#395

Test plan

• Build realtime image locally
• CI passes
• Deploy staging + verify node --version = 20.20.0
• Deploy prod + verify

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Updates the Node.js base image tag in service Dockerfiles to a specific patch release (20.20.0-alpine) to mitigate the referenced Node CVE and ensure deployed containers run the intended Node version.

Changes:

• Bump FROM node:20-alpine to FROM node:20.20.0-alpine in realtime build + runtime stages
• Bump FROM node:20-alpine to FROM node:20.20.0-alpine in history build + runtime stages
• Bump history migration image to node:20.20.0-alpine

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
realtime/Dockerfile	Pins Node base image tag to 20.20.0-alpine for build + runtime stages.
history/Dockerfile	Pins Node base image tag to 20.20.0-alpine for build + runtime stages.
history/Dockerfile-migrate	Pins Node base image tag to 20.20.0-alpine for the migration image.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Using a mutable tag (even with a pinned Node patch) can still lead to non-reproducible builds if the tag is rebuilt. For stronger supply-chain/reproducibility guarantees, consider pinning the base image by digest (node@sha256:...) and/or an explicit Alpine variant (e.g., -alpine3.xx) in both stages.

[Copilot]

Using a mutable tag (even with a pinned Node patch) can still lead to non-reproducible builds if the tag is rebuilt. For stronger supply-chain/reproducibility guarantees, consider pinning the base image by digest (node@sha256:...) and/or an explicit Alpine variant (e.g., -alpine3.xx) in both stages.

[Copilot]

Using a mutable tag (even with a pinned Node patch) can still lead to non-reproducible builds if the tag is rebuilt. For stronger supply-chain/reproducibility guarantees, consider pinning the base image by digest (node@sha256:...) and/or an explicit Alpine variant (e.g., -alpine3.xx).

Suggested change

	FROM node:20.20.0-alpine
	FROM node:20.20.0-alpine3.19