fix(06-06): patch OpenSSL CVE-2026-31789 — add apt-get upgrade to runtime Dockerfile stage

Apply all available OS security updates in the runtime image stage to pull in
openssl 3.5.5-1~deb13u2 (fixes CVE-2026-31789 heap buffer overflow). Three
CVEs with no upstream fix (Mesa will_not_fix, perl-base affected) documented
and suppressed in .trivyignore with rationale. Trivy rescan exits 0 (D-10 gate
passes).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.trivyignore

@@ -0,0 +1,27 @@
+# Trivy CVE ignore file — DocuVault
+# Each entry is a CVE ID that is accepted with documented rationale.
+# Reviewed: 2026-06-04
+
+# CVE-2026-40393 — Mesa out-of-bounds memory access (libgbm1, libgl1-mesa-dri, libglx-mesa0, mesa-libgallium)
+# Status: will_not_fix (Debian)
+# Rationale: Mesa GPU rendering libraries are pulled in as dependencies of libgl1 (required by
+#   PyMuPDF for PDF text extraction). In a headless server container, no GPU rendering is ever
+#   performed — the vulnerable GPU code paths are never invoked. Debian has reviewed this CVE
+#   and chosen not to fix it in the current release (will_not_fix). Re-evaluate when a fix
+#   becomes available or when libgl1 can be replaced with a GPU-stub alternative.
+CVE-2026-40393
+
+# CVE-2026-42496 — perl-archive-tar path traversal via crafted symlinks (perl-base)
+# Status: affected, no fix available
+# Rationale: perl-base is a mandatory component of the python:3.12-slim base image (Debian 13).
+#   It cannot be removed without rebuilding the base image. No patched version exists upstream.
+#   The vulnerability requires an attacker to supply a crafted tar archive to perl-archive-tar;
+#   DocuVault never processes tar archives via perl. Re-evaluate when Debian ships a patch.
+CVE-2026-42496
+
+# CVE-2026-8376 — Perl heap buffer overflow when compiling (perl-base)
+# Status: affected, no fix available
+# Rationale: Same as CVE-2026-42496. No fix available in Debian 13. The vulnerable code path
+#   (Perl regex compilation) is never invoked by DocuVault's Python runtime. Re-evaluate
+#   when Debian ships a patch.
+CVE-2026-8376

backend/Dockerfile

@@ -13,10 +13,12 @@ RUN pip install --no-cache-dir --prefix=/install -r requirements.txt
 # Stage 2: runtime — lean image with only what the app needs at runtime
 FROM python:3.12-slim AS runtime
 
-RUN apt-get update && apt-get install -y --no-install-recommends \
+RUN apt-get update \
-    tesseract-ocr \
+    && apt-get upgrade -y --no-install-recommends \
-    libgl1 \
+    && apt-get install -y --no-install-recommends \
-    libglib2.0-0 \
+        tesseract-ocr \
+        libgl1 \
+        libglib2.0-0 \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=builder /install /usr/local