fix: upgrade nginx base image to fix CVE-2026-42945 (CVSS 9.2 RCE)

Cherry-picked from upstream PR CorentinTh#1796 (zethis):
- Switch from nginx:stable-alpine (vulnerable 1.26.x) to nginx:1.31-alpine
- Fixes heap buffer overflow in ngx_http_rewrite_module allowing unauthenticated RCE
- Affected: nginx 0.6.27 - 1.30.0, fixed in 1.30.1/1.31.0

Author: 秦星星

Dockerfile

@@ -10,7 +10,7 @@ COPY . .
 RUN pnpm build
 
 # production stage
-FROM nginx:stable-alpine AS production-stage
+FROM nginx:1.31-alpine AS production-stage
 COPY --from=build-stage /app/dist /usr/share/nginx/html
 COPY nginx.conf /etc/nginx/conf.d/default.conf
 EXPOSE 80