fix(deps): pin Node 24.22.1 for the October 21, 2026 security release

Node.js 24.14.0 carries CVE-2026-111497 ("Node2Shell"), an out-of-bounds
write in the bundled Brotli decoder that can lead to remote code
execution, plus several high-severity DNS, TLS and URL-parsing fixes.
24.22.1 is the first patched 24.x release.

- Dockerfile: node:24.22.1-slim, digest re-pinned to the multi-arch index
- CI: 24.22.1 in the verify matrix and the other two jobs; the
  allocation-gate requirement now keys on 24.22.1
- Docs: contributor setup and the dependency baseline name 24.22.1

The engines floor and the setup doctor are unchanged.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

CONTRIBUTING.md

@@ -4,13 +4,15 @@ Thanks for being here. God's Eye View is an open foundation for live spatial int
 
 ## Getting set up
 
-Use Node.js 24.14.x or 26.x (also enforced by `package.json`).
+Use Node.js 24.14.x or 26.x (also enforced by `package.json`). Prefer 24.22.1 or
+later: earlier releases lack the October 21, 2026 security fixes, including
+CVE-2026-111497 (a Brotli decoder flaw that can lead to remote code execution).
 
 ```bash
 git clone https://github.com/bilawalsidhu/gods-eye-view.git
 cd gods-eye-view
-nvm install 24.14.0
-nvm use 24.14.0
+nvm install 24.22.1
+nvm use 24.22.1
 npm install
 npm run doctor
 ./scripts/dev-fresh.sh        # or: npm run dev (keys are optional)