deps: stop re-raising two impossible majors; move node to 24 LTS

.devcontainer/devcontainer.json

@@ -5,8 +5,9 @@
   // so the build context is the whole workspace.
   "build": { "dockerfile": "Dockerfile", "context": ".." },
   "features": {
-    // Node 22 + npm, layered on top of the .NET 10 SDK base image.
-    "ghcr.io/devcontainers/features/node:2": { "version": "22" },
+    // Node 24 (LTS) + npm, layered on top of the .NET 10 SDK base image. Keep the
+    // version in step with the Dockerfile and ci.yml.
+    "ghcr.io/devcontainers/features/node:2": { "version": "24" },
     // Claude Code CLI (npm-based, so it needs the Node feature above).
     "ghcr.io/anthropics/devcontainer-features/claude-code:1.0": {},
     // GitHub CLI (`gh`). Auth comes from the GH_TOKEN env var below — gh picks it

.github/dependabot.yml

@@ -24,6 +24,18 @@ updates:
       dotnet-major:
         patterns: ["*"]
         update-types: [major]
+    # Two majors are permanently out of reach, so don't re-raise them weekly. Both were
+    # tried and closed with the build output on the PR; revisit only if the cause changes.
+    ignore:
+      # 4.x demands a paid Six Labors license key at build time:
+      # "No Six Labors license found. Set $(SixLaborsLicenseKey) ..."
+      - dependency-name: SixLabors.ImageSharp
+        update-types: [version-update:semver-major]
+      # 3.x makes IOpenApiMediaType.Example read-only, which the
+      # Microsoft.AspNetCore.OpenApi source generator still assigns to (CS0200).
+      # Unblocked only by an ASP.NET Core release built against OpenApi 3.x.
+      - dependency-name: Microsoft.OpenApi
+        update-types: [version-update:semver-major]
     labels: [dependencies, dotnet]
     commit-message:
       prefix: deps

.github/workflows/ci.yml

@@ -61,7 +61,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
-          node-version: 22
+          node-version: 24
           cache: npm
           cache-dependency-path: frontend/package-lock.json
       - working-directory: frontend
@@ -99,7 +99,7 @@ jobs:
           dotnet-version: 10.0.x
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
-          node-version: 22
+          node-version: 24
           cache: npm
           cache-dependency-path: frontend/package-lock.json
       # Start the API on :5000 in the background. Development → REGISTRATION_ENABLED

Dockerfile

@@ -3,8 +3,10 @@
 # same-origin from the API on :8080. Built for linux/amd64 (the Unraid NAS).
 
 # --- Stage 1: build the Angular PWA ---
-# node:22-slim
-FROM node:22-slim@sha256:53ada149d435c38b14476cb57e4a7da73c15595aba79bd6971b547ceb6d018bf AS web
+# node:24-slim -- keep in step with ci.yml's node-version and the devcontainer's
+# node feature. 24 is the current LTS; frontend/package.json's engines field allows
+# ^20.19 || ^22.12 || ^24, so odd-numbered (non-LTS) majors are deliberately skipped.
+FROM node:24-slim@sha256:ba849c60be29959425b8734d57b8b4b7d56f98edd9504c9af091d5281095a71e AS web
 WORKDIR /web
 # Restore deps in their own layer (cached until a manifest changes). This is an npm
 # workspaces repo, so `npm ci` needs every member's package.json present up front —

README.md

@@ -29,7 +29,7 @@ Development happens inside a dev container, so the only host prerequisites are
 
 1. Clone the repo and open it in VS Code.
 2. Run **Dev Containers: Reopen in Container**. The first build installs the .NET
-   10 SDK, Node 22, the Angular CLI, `dotnet-ef`, and the native Tesseract OCR
+   10 SDK, Node 24, the Angular CLI, `dotnet-ef`, and the native Tesseract OCR
    libraries, then prints a toolchain summary.
 3. The API runs HTTP-only on `http://localhost:5000` and the Angular dev server on
    `http://localhost:4200` (both forwarded automatically). `http://localhost` is a