fix(auth): bump better-auth to 1.6.33, node to 22

- CVE-2026-53514 (HIGH): better-auth <1.6.11 vulnerable to
  unverified-email invitation acceptance; pinned 1.6.33 (1.7.x breaks
  the migration introspection + schema check on this setup)
- qs override to >=6.16.0 clears moderate DoS via express
- kysely audit fix pulled 0.29.x requiring node>=22; node:20 is EOL
  anyway - both Dockerfiles now on node:22-alpine, matching CI
- npm audit: 0 vulnerabilities; e2e verified (migrations run,
  sign-up returns session)

Authored By: TDvorak <[email protected]>

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

app/backend/Dockerfile

@@ -12,7 +12,7 @@ COPY . .
 RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o main cmd/server/main.go
 
 # Build embedded Better Auth runtime dependencies
-FROM node:20-alpine AS auth-builder
+FROM node:22-alpine AS auth-builder
 
 WORKDIR /auth
 
@@ -22,7 +22,7 @@ RUN npm ci --omit=dev
 COPY auth/src ./src
 
 # Final runtime image (Go API + Better Auth sidecar in one container)
-FROM node:20-alpine
+FROM node:22-alpine
 
 RUN apk --no-cache add ca-certificates tzdata wget