chore(docker): pin secure runtime and resolve MCP dependencies

infra/docker/docker-compose.yml

@@ -27,7 +27,7 @@ services:
 
   # --- Keycloak ---
   keycloakDB:
-    image: postgis/postgis:14-3.5
+    image: postgis/postgis:14-3.5@sha256:2543ae2bc9497ca62cd740268be228f7a6974020207634e2b189fe36be82b749
     container_name: keycloakDB
     restart: always
     environment:
@@ -41,7 +41,7 @@ services:
       - ./keycloak/db_data:/var/lib/postgresql/data
 
   keycloak:
-    image: keycloak/keycloak:latest
+    image: keycloak/keycloak:26.8.1@sha256:79c623a22abacf3fe6c00a5fb30f5b7843d717b234033b80995891c06116d244
     container_name: keycloak
     restart: always
     environment:
@@ -69,7 +69,7 @@ services:
     depends_on:
       - keycloakDB
 
-  # --- TimescaleDB & Grafana ---
+  # --- TimescaleDB ---
   timescaledb:
     image: timescale/timescaledb:latest-pg15
     container_name: timescaledb
@@ -83,23 +83,9 @@ services:
     volumes:
       - ./timescaledb/data:/var/lib/postgresql/data
 
-  grafana:
-    image: grafana/grafana:latest
-    container_name: grafana
-    restart: always
-    ports:
-      - "${GRAFANA_PORT}:3000"
-    depends_on:
-      - timescaledb
-    volumes:
-      - ./timescaledb/grafana_data:/var/lib/grafana
-    environment:
-      - GF_SECURITY_ADMIN_USER=${GRAFANA_ADMIN_USER}
-      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD}
-
   # --- MapService (PostGIS & GeoServer) ---
   postgis:
-    image: postgis/postgis:14-3.5
+    image: postgis/postgis:14-3.5@sha256:2543ae2bc9497ca62cd740268be228f7a6974020207634e2b189fe36be82b749
     container_name: postgis
     restart: always
     environment:
@@ -124,7 +110,7 @@ services:
       - ./mapservice/data:/var/lib/postgresql/data
 
   geoserver:
-    image: docker.osgeo.org/geoserver:2.27.1
+    image: docker.osgeo.org/geoserver:2.28.5@sha256:c6a3f3ef32c8b39e8a93ef54346cbe62f212ed27f1c49c3ff51cbae5a9b70e84
     container_name: geoserver
     restart: always
     ports: