fix: upgrade nodemailer to 8.x with override, fix Docker arm64 build

- Upgrade nodemailer 7.0.13 → 8.0.4 (fixes GHSA-c7w3-x93f-qmm8)
- Add npm overrides to resolve next-auth peer dep conflict
- Remove --legacy-peer-deps from Dockerfile (no longer needed)
- Key Docker cache mounts by TARGETPLATFORM to fix ETXTBSY on
  QEMU arm64 cross-compilation

Author: GeiserX

Dockerfile

@@ -27,8 +27,10 @@ COPY package.json package-lock.json* ./
 
 # Install dependencies using npm ci (faster for CI/Docker)
 # Uses BuildKit cache mount for npm cache (~30-50% faster on rebuilds)
-RUN --mount=type=cache,target=/root/.npm \
-    npm ci --legacy-peer-deps
+# Cache keyed by TARGETPLATFORM to avoid ETXTBSY on QEMU cross-compilation
+ARG TARGETPLATFORM
+RUN --mount=type=cache,target=/root/.npm,id=npm-${TARGETPLATFORM} \
+    npm ci
 
 # -----------------------------------------------------------------------------
 # Builder stage - build the application
@@ -72,8 +74,9 @@ FROM base AS prisma-deps
 WORKDIR /prisma-deps
 
 COPY --from=builder /app/package.json ./
-RUN --mount=type=cache,target=/root/.npm \
-    npm install --no-save --legacy-peer-deps prisma tsx esbuild get-tsconfig resolve-pkg-maps
+ARG TARGETPLATFORM
+RUN --mount=type=cache,target=/root/.npm,id=npm-prisma-${TARGETPLATFORM} \
+    npm install --no-save prisma tsx esbuild get-tsconfig resolve-pkg-maps
 
 # -----------------------------------------------------------------------------
 # Production stage - minimal runtime image

package-lock.json

@@ -70,7 +70,7 @@
     "next": "^16.2.2",
     "next-auth": "^4.24.13",
     "next-themes": "^0.4.4",
-    "nodemailer": "^7.0.13",
+    "nodemailer": "^8.0.4",
     "pg": "^8.20.0",
     "react": "^19.2.4",
     "react-dom": "^19.2.4",
@@ -126,5 +126,8 @@
   },
   "prisma": {
     "seed": "tsx prisma/seed.ts"
+  },
+  "overrides": {
+    "nodemailer": "$nodemailer"
   }
 }