docker: image for the Oracle server, Trivy gate, and a release workflow

Next standalone build in three stages, non-root, healthchecked. next 15.5.28
(image-optimiser RCE) with postcss pinned past the copy bundled by next.
release.yml publishes linux/arm64 to the Gitea registry. The book/ directory is
a repository of its own and stays out of the build context.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

package.json

@@ -16,7 +16,7 @@
   "dependencies": {
     "googleapis": "^165.0.0",
     "lucide-react": "^1.16.0",
-    "next": "^15.5.9",
+    "next": "^15.5.28",
     "next-themes": "^0.4.6",
     "react": "19.1.0",
     "react-dom": "19.1.0"
@@ -28,5 +28,10 @@
     "eslint-config-next": "15.5.6",
     "puppeteer": "^25.8.0",
     "tailwindcss": "^4"
+  },
+  "overrides": {
+    "next": {
+      "postcss": "^8.5.25"
+    }
   }
 }