Add full XCA curve and digest parity

server/Dockerfile

@@ -29,12 +29,15 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \
     trunk build --release --public-url /static/
 
 # --- Backend ---------------------------------------------------------------
-FROM alpine:3.24 AS builder
+FROM python:3.12-slim-trixie AS builder
 
 COPY --from=ghcr.io/astral-sh/uv:0.13.1 /uv /uvx /bin/
 
-RUN --mount=type=cache,target=/var/cache/apk \
-    apk add python3 build-base python3-dev git
+RUN sed -i 's|http://deb.debian.org|https://deb.debian.org|g' \
+        /etc/apt/sources.list.d/debian.sources 2>/dev/null || true \
+ && apt-get update \
+ && apt-get install -y --no-install-recommends build-essential git \
+ && rm -rf /var/lib/apt/lists/*
 RUN git config --global --add safe.directory /repo
 
 ENV UV_PYTHON_DOWNLOADS=0 \
@@ -56,11 +59,15 @@ RUN --mount=type=cache,target=/root/.cache/uv \
 COPY server/migrations ./migrations
 
 # --- Runtime ---------------------------------------------------------------
-FROM alpine:3.24
+FROM python:3.12-slim-trixie
 
-RUN --mount=type=cache,target=/var/cache/apk \
-    apk add python3 ca-certificates tzdata \
- && addgroup -S app && adduser -S -G app app
+RUN sed -i 's|http://deb.debian.org|https://deb.debian.org|g' \
+        /etc/apt/sources.list.d/debian.sources 2>/dev/null || true \
+ && apt-get update \
+ && apt-get install -y --no-install-recommends ca-certificates tzdata libssl3 \
+ && rm -rf /var/lib/apt/lists/* \
+ && groupadd --system app \
+ && useradd --system --gid app --no-create-home --shell /usr/sbin/nologin app
 
 COPY --from=builder /opt/venv /opt/venv
 COPY --from=builder /repo/server/migrations /app/migrations
@@ -82,6 +89,6 @@ USER app
 EXPOSE 8080
 
 HEALTHCHECK --interval=30s --timeout=3s --start-period=10s \
-  CMD wget -q -O- http://127.0.0.1:8080/api/health || exit 1
+  CMD python -c "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/api/health', timeout=2).read()" || exit 1
 
 CMD ["granian", "kca.app:app"]