fix(docker): bump frontend image to Node 22 for pdfjs-dist engine requirement

pdfjs-dist resolves to 5.7.284, which requires Node >=22.13.0 || >=24.
With engine-strict=true in .npmrc, npm ci hard-fails on the Node 20 base
image, so the frontend dev server crash-loops (and a clean build fails).
CI runs the frontend on Node 22 (Playwright image), so the committed
lockfile already assumes 22. Bump all three Dockerfile stages to match.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

frontend/Dockerfile

@@ -4,7 +4,7 @@
 # Used by docker-compose.yml (target: development). Source is bind-mounted in
 # dev so the COPY . below is effectively replaced at runtime; the layer still
 # exists so the image is self-contained for cold starts (e.g. devcontainer).
-FROM node:20.19.0-alpine3.21 AS development
+FROM node:22-alpine3.21 AS development
 WORKDIR /app
 COPY package.json package-lock.json ./
 RUN npm ci
@@ -14,7 +14,7 @@ CMD ["npm", "run", "dev"]
 
 # ── Build ────────────────────────────────────────────────────────────────────
 # Compiles the SvelteKit Node-adapter output to /app/build.
-FROM node:20.19.0-alpine3.21 AS build
+FROM node:22-alpine3.21 AS build
 WORKDIR /app
 # VITE_SENTRY_DSN is a build-time variable — Vite bakes it into the bundle.
 # Passed via docker-compose build.args; empty string disables the SDK.
@@ -27,7 +27,7 @@ RUN npm run build
 
 # ── Production ───────────────────────────────────────────────────────────────
 # Self-contained Node server. `node build` is the adapter-node entrypoint.
-FROM node:20.19.0-alpine3.21 AS production
+FROM node:22-alpine3.21 AS production
 WORKDIR /app
 ENV NODE_ENV=production
 COPY --from=build /app/build ./build