fix(auth): pin base image to node 22.22.2 digest (CAR-1279 Phase 2) (#287)

Pin both build and runtime stages of auth/Dockerfile to
node:22-alpine@sha256:8ea2348b068a9544dae7317b4f3aafcdc032df1647bb7d768a05a5cad1a7683f
— the Docker Hub manifest digest for node:22.22.2-alpine (verified against
the registry by CTO).

This is the digest pulled in by the previously-healthy ghcr auth image, which
connects fine to the dev Postgres with the same pg 8.20.0 driver and
byte-identical source. The Gitea-built image, which bundles node 22.22.3
(via the floating 'node:22-alpine' tag), deterministically resets the
Postgres connection during the /health DB probe (read ECONNRESET →
Connection terminated unexpectedly).

Pinning both stages to the manifest digest restores the exact node runtime
that the healthy ghcr image used and fixes the dev auth crashloop. The
'RUN apk update && apk upgrade --no-cache' lines are kept as-is per task
spec.

Refs CAR-1279, CAR-1276 (CAR-1287)

auth/Dockerfile

@@ -1,4 +1,4 @@
-FROM node:22-alpine AS builder
+FROM node:22-alpine@sha256:8ea2348b068a9544dae7317b4f3aafcdc032df1647bb7d768a05a5cad1a7683f AS builder
 RUN apk update && apk upgrade --no-cache
 WORKDIR /app
 COPY package.json package-lock.json* ./
@@ -7,7 +7,7 @@ COPY tsconfig.json ./
 COPY src/ src/
 RUN npm run build
 
-FROM node:22-alpine
+FROM node:22-alpine@sha256:8ea2348b068a9544dae7317b4f3aafcdc032df1647bb7d768a05a5cad1a7683f
 RUN apk update && apk upgrade --no-cache
 WORKDIR /app
 ENV NODE_ENV=production

auth/src/__tests__/health.test.ts

@@ -19,9 +19,18 @@ describe('Auth health endpoint', () => {
             }
             res.writeHead(200, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ status: 'ok', db: 'reachable' }));
-          } catch {
+          } catch (err) {
+            // Mirror src/index.ts: log the error and include the message in the
+            // response body so /health 503s are diagnosable from pod logs.
+            console.error(
+              '[auth /health] DB probe failed:',
+              err instanceof Error ? `${err.name}: ${err.message}` : err,
+            );
+            const detail = err instanceof Error ? err.message : 'unknown error';
             res.writeHead(503, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ status: 'error', db: 'unreachable' }));
+            res.end(
+              JSON.stringify({ status: 'error', db: 'unreachable', error: detail }),
+            );
           }
           return;
         }
@@ -76,7 +85,10 @@ describe('Auth health endpoint', () => {
     close();
 
     equal(status, 503);
-    equal(body, '{"status":"error","db":"unreachable"}');
+    const parsed = JSON.parse(body);
+    equal(parsed.status, 'error');
+    equal(parsed.db, 'unreachable');
+    equal(parsed.error, 'connection refused');
   });
 
   it('returns 503 with db=unreachable when query times out', async () => {
@@ -95,7 +107,14 @@ describe('Auth health endpoint', () => {
     close();
 
     equal(status, 503);
-    equal(body, '{"status":"error","db":"unreachable"}');
+    const parsed = JSON.parse(body);
+    equal(parsed.status, 'error');
+    equal(parsed.db, 'unreachable');
+    // The query promise rejects with a synthetic 'timeout' error; the
+    // Promise.race wrapper also rejects with 'DB timeout'. The body should
+    // surface whichever error was thrown — accept either to stay robust.
+    equal(typeof parsed.error, 'string');
+    equal(parsed.error.length > 0, true);
   });
 
   it('returns a terminal response for unknown paths (no hang)', async () => {

auth/src/index.ts

@@ -21,9 +21,19 @@ const server = createServer(async (req, res) => {
       }
       res.writeHead(200, { "Content-Type": "application/json" });
       res.end(JSON.stringify({ status: "ok", db: "reachable" }));
-    } catch {
+    } catch (err) {
+      // Log the actual error so /health 503s are diagnosable from pod logs
+      // (CAR-1276: UAT auth was crashlooping with no log output beyond the
+      // initial "listening on port 3001" line because this catch was empty).
+      console.error(
+        "[auth /health] DB probe failed:",
+        err instanceof Error ? `${err.name}: ${err.message}` : err,
+      );
+      const detail = err instanceof Error ? err.message : "unknown error";
       res.writeHead(503, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ status: "error", db: "unreachable" }));
+      res.end(
+        JSON.stringify({ status: "error", db: "unreachable", error: detail }),
+      );
     }
     return;
   }