fix(frontend): resolve npm vulnerabilities for Trivy (picomatch, brac…

backend/Dockerfile

@@ -10,6 +10,12 @@ RUN pip install --no-cache-dir -r requirements.txt
 
 COPY app ./app
 
+RUN groupadd --gid 1000 app \
+    && useradd --uid 1000 --gid app --home-dir /app --no-create-home app \
+    && chown -R app:app /app
+
+USER app
+
 ENV PORT=8000
 EXPOSE 8000
 

frontend/Dockerfile

@@ -1,16 +1,25 @@
-# Stage 1: Dependencies — install npm packages
+# Stage 1: Dependencies — install npm packages (non-root)
 FROM node:20-alpine AS deps
+RUN addgroup --system --gid 1001 nodejs \
+  && adduser --system --uid 1001 -G nodejs nextjs
 WORKDIR /app
-COPY package.json package-lock.json ./
+COPY --chown=nextjs:nodejs package.json package-lock.json ./
+# WORKDIR is root-owned by default; allow nextjs to create node_modules
+RUN chown nextjs:nodejs /app
+USER nextjs
 RUN npm ci
 
-# Stage 2: Builder — production build
+# Stage 2: Builder — production build (non-root)
 FROM node:20-alpine AS builder
+RUN addgroup --system --gid 1001 nodejs \
+  && adduser --system --uid 1001 -G nodejs nextjs
 WORKDIR /app
 ENV NODE_ENV=production
 ENV NEXT_TELEMETRY_DISABLED=1
-COPY --from=deps /app/node_modules ./node_modules
-COPY . .
+COPY --from=deps --chown=nextjs:nodejs /app/node_modules ./node_modules
+COPY --chown=nextjs:nodejs . .
+RUN chown -R nextjs:nodejs /app
+USER nextjs
 RUN npm run build
 
 # Stage 3: Runner — minimal production image
@@ -22,7 +31,7 @@ ENV PORT=3000
 ENV HOSTNAME=0.0.0.0
 
 RUN addgroup --system --gid 1001 nodejs \
-  && adduser --system --uid 1001 nextjs
+  && adduser --system --uid 1001 -G nodejs nextjs
 
 COPY --from=builder /app/public ./public
 COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./

frontend/app/page.tsx

@@ -1,7 +1,6 @@
 "use client";
 
 import { useCallback, useEffect, useState } from "react";
-import Image from "next/image";
 import { Loader2 } from "lucide-react";
 import { Badge } from "@/components/ui/badge";
 import { Card } from "@/components/ui/card";
@@ -97,13 +96,12 @@ export default function Home() {
               used for medical decision-making.
             </div>
           </div>
-          <Image
+          <img
             src="/logo.png"
             alt="Cloud2 Labs"
             width={140}
             height={50}
             className="shrink-0 opacity-90 transition-opacity hover:opacity-100"
-            priority
           />
         </header>