[keeganwitt]

Update the Go module, Makefile compiler, and both backend builders to Go 1.26.10; update CI and Alpine frontend stages to Node 24.22.1. These include the Go certificate-verifier mitigation and Node trust-store update associated with the eMudhra incident. Upgrade golangci-lint to v2.11.4, whose released binary supports Go1.26. Update quickstart/TLS example SPIRE images to the published security release 1.15.5.

Tornjak's public-Web-PKI OIDC discovery/JWKS client is a potential affected runtime trust boundary. Exploitability also requires an accepted affected certificate chain and interception of traffic; no vulnerable deployment or compromise has been established. SPIFFE/private-root connections have different trust boundaries. Node dependency acquisition is a build-time HTTPS path; no outbound public-root Node runtime path was identified.

The UBI frontend runtime moves from unsupported Node18 to the maintained ubi9/nodejs-24-minimal channel. This is not a verified fixed UBI runtime: the current amd64 manifest was built October13, before the mitigation. A vendor refresh and rebuild still need verification. The Keycloak19.0.1 example is unchanged because a compatible vendor-mitigated JVM image has not been established; this PR does not claim to resolve that separate trust-store concern.

Validation:

• Official registry manifests confirmed golang:1.26.10-alpine3.23, node:24.22.1-alpine, and the UBI24 image exist.
• Locked frontend installation and production build passed with exact Node24.22.1.
• Go1.26.10 Windows tests compiled all packages; SQLite tests failed with persistent fixture rows, consistent with cleanup ignoring failed Windows removal of open database files. Linux/native and container execution remain unverified (no GCC/Docker daemon).
• Frontend: 2 suites / 9 tests passed on Node24.22.1 (explicit testMatch avoids react-scripts Windows worktree-path discovery issue). golangci-lint v2.11.4 with Go1.26.10 and the repository default configuration reported 0 issues.

References: https://pkg.go.dev/vuln/GO-2026-6809 ; https://nodejs.org/en/blog/release/v24.22.1 ; https://github.com/spiffe/spire/releases/tag/v1.15.5 ; https://access.redhat.com/security/vulnerabilities/RHSB-2026-012