Dockerfile: fix two independent aarch64 build/runtime failures

[ibrahiem9]

The image can't be built or run on linux/arm64 today. Two independent defects stack, so fixing either one alone still fails — I spent a couple of builds thinking I'd found "the" root cause before realising there were two.

1. Build time — fails on any Debian release

npm ci --omit=dev finds no better-sqlite3 prebuild matching this node/arch and falls back to node-gyp rebuild, which dies on node:*-slim:

Error: not found: make

Fix: install build-essential + python3, run the install, and purge them in the same layer so the toolchain doesn't land in the final image.

2. Runtime — bookworm only, and it doesn't fail at startup

better-sqlite3 ships a bundled prebuilds/linux-arm64.node linked against GLIBC_2.38. Bookworm ships 2.36. The module resolves fine, the server starts and reports healthy, and then the first tab open throws:

ERR_DLOPEN_FAILED: /app/node_modules/better-sqlite3/prebuilds/linux-arm64.node:
  /lib/aarch64-linux-gnu/libc.so.6: version `GLIBC_2.38' not found

node:22-trixie-slim ships glibc 2.41, which satisfies it.

Worth noting for anyone who tries the obvious workaround first: npm_config_build_from_source=true + npm rebuild --build-from-source does not fix this. The loader prefers the bundled prebuilds/<platform>-<arch>.node file over anything in build/Release/, and the forced build left .deps + obj.target behind with no linked .node — a half-build that looks like a build. Matching the glibc is the reliable fix; the alternative is rm -rf node_modules/better-sqlite3/prebuilds, which felt more invasive than a base bump.

Package rename that comes with trixie

libegl1-mesa is dropped in trixie — it's libegl1 now. libgl1-mesa-dri, libgbm1 and libasound2 are unchanged (no t64 churn on these).

What I tested

linux/arm64 only, on Amazon Linux 2023 / aarch64:

• Image builds clean from a cold cache.
• /health returns {"ok":true,"engine":"camoufox","browserConnected":true,"browserRunning":true,"activeTabs":2,...} with tabs actually open — i.e. past the point where defect 2 used to throw.
• ldd --version in the image reports 2.41, and libEGL.so.1 is present.

I have not built or run this on amd64. amd64 is unaffected by defect 2 (its prebuild targets an older glibc), so for amd64 this change is a base-image bump plus the toolchain fix from defect 1. If you'd rather not move the base image for everyone, the alternative is a conditional on TARGETARCH — happy to rework it that way, or to split the two fixes into separate commits if that's easier to review.