fix(security): bump pip to >=26.1 in Dockerfile (CVE-2026-6357)

  The python:3.13-slim-trixie base image ships pip 26.0.1, which runs its
  self-update check after installing wheels — a malicious wheel that included
  a module name matching a deferred stdlib import (urllib, ssl, ...) could
  hijack the import inside the install step. GitHub code-scanning alert #778
  flagged this as medium-severity.

  Dockerfile now upgrades pip to >=26.1 immediately before the requirements.txt
  install, so the requirements install runs under the patched pip and the
  resulting dist-info metadata in the final image is the fixed version.
  No requirements.txt change — the floor is enforced at the image-build layer
  where the vulnerable copy actually lived.

Dockerfile

@@ -47,10 +47,14 @@ RUN curl -fsSL https://pkgs.tailscale.com/stable/debian/trixie.noarmor.gpg \
 # which depends on ambient capability support in the container runtime.
 RUN setcap cap_net_bind_service=+ep "$(readlink -f /usr/local/bin/python3)"
 
-# Install Python dependencies with cache mount
+# Install Python dependencies with cache mount.
+# pip is upgraded to >=26.1 first to close CVE-2026-6357 — the python:3.13-slim
+# base image ships pip 26.0.1, which runs its self-update check after installing
+# wheels (so a hostile wheel could hijack stdlib imports during install).
 COPY requirements.txt ./
 RUN --mount=type=cache,target=/root/.cache/pip \
-    pip install --root-user-action=ignore -r requirements.txt
+    pip install --root-user-action=ignore --upgrade 'pip>=26.1' \
+ && pip install --root-user-action=ignore -r requirements.txt
 
 # Copy backend
 COPY backend/ ./backend/