Astro 7: the demo was the last thing still on Astro 5

npm audit had one critical finding here (the Astro 5 advisories, among
them the AVIF RCE) — irrelevant at runtime for a static site served by
nginx, but the build toolchain ran it. Now 0.

Build image node 20 -> 22, and npm ci only: the old '|| npm install'
fallback meant a broken lockfile would silently build something untested.

Checked in a real browser: all six pages 200, sheet drawn, PDF download
measures 210.00 x 297.00 mm in both languages, no horizontal scroll at
390 px.

Dockerfile

@@ -1,9 +1,9 @@
 # Build the static site, then serve it with nginx. Two stages, so the image that
 # runs carries no toolchain — about 50 MB instead of about 400.
-FROM node:20-bookworm-slim AS build
+FROM node:22-bookworm-slim AS build
 WORKDIR /app
 COPY package.json package-lock.json* ./
-RUN npm ci --no-audit --no-fund || npm install --no-audit --no-fund
+RUN npm ci --no-audit --no-fund
 COPY . .
 RUN npm run build