security(docker): Pin base images by digest

## Summary The multi-stage Dockerfile selects base images only by mutable tags. ## Evidence - `Dockerfile:2`, `Dockerfile:17`, and `Dockerfile:26` use tag-only image references. - The stages use official Node and Python images but do not record immutable digests. ## Why this matters A mutable base tag can resolve to different content between builds, weakening reproducibility and supply-chain review. Digest pins make the exact base content explicit. ## Scope Pin every base image to a verified digest while retaining a readable tag. Confirm multi-stage aliases and supported architectures still build, and document the safe update procedure. ## Acceptance criteria - [ ] All `FROM` references include `tag@sha256:digest`. - [ ] Digests are taken from the official image registry/manifests. - [ ] The production target builds for the project's supported architecture(s). - [ ] A short comment or maintainer note explains how pins are refreshed. - [ ] No credentials or registry tokens are committed. ## Verification ```powershell rg -n "^FROM " Dockerfile docker build --target production -t openalgo-security-check . ``` ## Security guidance Do not post or use real API keys, access tokens, OTPs, passwords, or broker credentials. Use obvious test values such as `test-token-not-real` and keep regression tests fully local. ## First-time contributor notes - Difficulty: Medium - Estimated time: 2-4 hours - Broker credentials required: No - You will learn: container reproducibility, OCI digests, and supply-chain maintenance. - Please comment on this issue before starting so contributors can avoid duplicate work.