[SamsonNegedu]

Summary

One PR for all 10 open Dependabot PRs. Stacked on #33 (it needs that vulnerability fix and the new Dependabot limits), so merge #33 first and this retargets to main.

Go (go.mod)         compose-go 2.16.2, gin 1.12.0, go-pkgz/auth 1.27.1, gopsutil 3.24.5,
                    pflag 1.0.10, x/sync, x/term, modernc sqlite 1.28 -> 1.61.0
                    + quic-go 0.59.1 (indirect, GO-2026-5676, pulled in by gin)
Web (web/)          23 minor/patch bumps, zustand 5, tailwind-merge 3, agentation 3
Docker images       golang 1.26 -> 1.27-alpine, node 24 -> 26-alpine
CI actions          checkout 7, setup-go 7, paths-filter 4, frontend tests on Node 26

Replaces #1, #34, #2, #8, #10, #11, #12, #18, #26, #27, #31.
Not taken: Dependabot's golang.org/x/net v0.59 in #8 (older than the fix). It would undo the security fix in #33, so this uses v0.62.0.

Evidence

• Before: the Dependabot PRs fail Go vet, tests, vulnerabilities (the vulnerabilities fixed in fix: clear govulncheck findings, slow Dependabot to save CI minutes #33) and several had no passing combined run.
  After, run locally:
  • go build, go vet and go test ./... pass.
  • CI's govulncheck filter reports no reachable findings (GO-2025-3553 stays accepted).
  • web: npm run lint clean, 97 tests pass, tsc plus vite build pass, npm audit reports 0 vulnerabilities.
• Not run locally: the Docker image builds on golang 1.27 and node 26, and the CI workflow changes. CI on this PR covers them.

Merge Danger

Door: two-way

Blast Radius: Wide

• Most-likely trouble spots: the major bumps (zustand 5, tailwind-merge 3, agentation 3), the sqlite jump (pure Go, still no CGO), and the new base images. Checks above pass, but a manual click-through of the UI is still worth doing.
• If a build fails on the Docker images, revert Dockerfile* and web/Dockerfile* only.