Run pixad on the Alpine release it is built on (closes #229)

The runtime stage of the Dockerfile moves from alpine:3.21 to
alpine:3.22, pinned by digest. The test phase and the build stage use
the golang image built on Alpine 3.22, so pixad was compiled against
libvips 8.16 and ran against 8.15. All three stages now install their
packages from the same Alpine release, where the runtime packages keep
their names. The golang pins now name that release as
golang:1.25.4-alpine3.22, with the same digest, and say that the runtime
stage uses it too. README.md now says the image has libvips 8.16.

Model: opus-5-5

Dockerfile

@@ -17,8 +17,8 @@ COPY . .
 RUN golangci-lint run --config .golangci.yml ./...
 
 # Test phase. script/test builds it alone.
-# golang:1.25.4-alpine, 2026-02-25
+# golang:1.25.4-alpine3.22, 2026-02-25; the runtime stage uses Alpine 3.22 too
-FROM golang:1.25.4-alpine@sha256:d3f0cf7723f3429e3f9ed846243970b20a2de7bae6a5b66fc5914e228d831bbb AS test
+FROM golang:1.25.4-alpine3.22@sha256:d3f0cf7723f3429e3f9ed846243970b20a2de7bae6a5b66fc5914e228d831bbb AS test
 
 WORKDIR /src
 
@@ -40,8 +40,8 @@ RUN go test -count=1 -timeout 90s -race -cover ./... || \
 # Build stage. Nothing is wanted from the two phases above: these copies
 # make BuildKit build them first, so this stage runs only when lint and
 # test passed.
-# golang:1.25.4-alpine, 2026-02-25
+# golang:1.25.4-alpine3.22, 2026-02-25; the runtime stage uses Alpine 3.22 too
-FROM golang:1.25.4-alpine@sha256:d3f0cf7723f3429e3f9ed846243970b20a2de7bae6a5b66fc5914e228d831bbb AS builder
+FROM golang:1.25.4-alpine3.22@sha256:d3f0cf7723f3429e3f9ed846243970b20a2de7bae6a5b66fc5914e228d831bbb AS builder
 
 COPY --from=lint /src/go.sum /dev/null
 COPY --from=test /src/go.sum /dev/null

TODO.md

@@ -32,8 +32,8 @@ P2: security: per-IP rate limiting on the image routes
 
 - 2026-10-08 pixad runs on the Alpine release it is built on (closes #229): the
   runtime stage of the `Dockerfile` uses `alpine:3.22`, the release of the
-  `golang:1.25.4-alpine` image that the test phase and the build stage use, so
+  `golang:1.25.4-alpine3.22` image that the test phase and the build stage use,
-  all three have libvips 8.16 instead of 8.15 in the runtime image.
+  so all three have libvips 8.16, where the runtime image had 8.15.
 - 2026-10-08 requests no longer wait behind eviction queries that read a whole
   table (closes #227): the new `cache_usage` table holds the total cache usage,
   kept up to date by triggers on `source_content` and `variant_content` in the