chore: hardens docker image for production [#51]

[robert-7]

Summary

Closes #51

Hardens the Docker image and the e2e-docker pipeline for production readiness and reliability.

Changes

Docker hardening

• Pins the base image to a specific digest (python:3.13-slim@sha256:...) to prevent supply-chain drift
• Creates and switches to a non-root appuser in the Dockerfile
• Adds a .dockerignore to exclude dev files from the image

Dependency hygiene

• Extracts dev-only packages into requirements-dev.txt; production image only installs requirements.txt
• Sorts both requirements files case-insensitively
• Updates npm packages to resolve 2 audit vulnerabilities (brace-expansion moderate, flatted high)
• Updates CI to install requirements-dev.txt for the test job

Docker Compose & seeding reliability

• Adds a healthcheck to the mongodb service (mongosh --eval "db.adminCommand('ping')") so dependent services wait for a ready database rather than a running container
• Updates mongo-seed to use depends_on: mongodb: condition: service_healthy instead of links
• Adds e2e-tests dependency on mongo-seed: condition: service_completed_successfully so tests never run against an unseeded database
• Adds --drop to both mongoimport calls to make seeding idempotent
• Drops the enrollment collection during seeding to prevent stale enrollment records from causing false duplicate-enrollment failures across test runs

Bash script quality

• Adds set -e to mongo-setup.sh so the script aborts on the first failure rather than silently continuing
• Refactors duplicate import blocks into a reusable seed_collection function

Linting

• Adds shellcheck-py pre-commit hook for bash script linting

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!