perf: prepared statements, CSP, digest pin, вырезание design-preview, нагрузочные бюджеты, jsdom-тесты web, composite CI, SBOM/Trivy

deploy/docker/docker-bake.hcl

@@ -30,8 +30,13 @@ variable "CACHE_REF_NODE" {
   default = ""
 }
 
+# provenance + SBOM; включается только при --push (docker exporter attestations не поддерживает).
+variable "ATTEST" {
+  default = "false"
+}
+
 variable "BASE_NODE" {
-  default = "docker.io/library/node:22-alpine"
+  default = "docker.io/library/node:22-alpine@sha256:fe4f6d74e20370acb04ad889077d14d0f64a9c8ea6a42bc60cddf1e844699914"
 }
 
 function "node-cache-from" {
@@ -113,5 +118,6 @@ target "authportal" {
     build = "target:node-build"
   }
   cache-from = node-cache-from()
+  attest     = equal(ATTEST, "true") ? ["type=provenance,mode=min", "type=sbom"] : []
   tags       = concat(image-tags("authportal"), image-tags("auth-portal"))
 }