Harden client and WebSocket proxy

Dockerfile

@@ -1,7 +1,7 @@
 # Multi-stage build Dockerfile for Svelte MUD client
 
 # Build stage
-FROM node:20-alpine AS build
+FROM node:22-alpine AS build
 
 # Set working directory
 WORKDIR /app
@@ -10,7 +10,7 @@ WORKDIR /app
 COPY package*.json ./
 
 # Install dependencies
-RUN npm install
+RUN npm ci
 
 # Copy source files
 COPY . .
@@ -19,7 +19,7 @@ COPY . .
 RUN npm run build
 
 # Production stage
-FROM node:20-alpine AS production
+FROM node:22-alpine AS production
 
 # Set working directory
 WORKDIR /app
@@ -30,7 +30,7 @@ RUN addgroup -g 1001 -S nodejs && \
 
 # Install only production dependencies
 COPY package*.json ./
-RUN npm install --omit=dev
+RUN npm ci --omit=dev
 
 # Copy built application from the build stage
 COPY --from=build /app/build ./build
@@ -43,5 +43,6 @@ USER nodejs
 # Set environment variables
 ENV NODE_ENV=production
 
-# Start both servers using the production script
-CMD ["node", "run-production.js"]
+# Compose overrides this command to run the app and proxy separately. This
+# remains a convenient single-container fallback for local deployments.
+CMD ["node", "run-production.js"]