- Dockerfile: node:24-alpine base image
- compose: bind port 3000 to localhost so traffic goes through nginx
- JsonLd: escape '<' so data can't break out of the script tag
Moves off 16.3.0-canary.67, which predates the Sep/Oct 2026 Next.js
advisories (GHSA-673q, GHSA-2464, GHSA-p3m5, GHSA-vcvr, GHSA-cjq9, ...).
Pulls in sharp 0.35.5. Bumps @react-three/fiber to 9.8.2 for React 19.3.