chore(deps): update all dependency versions to latest stable releases [DEV-1]

Summary

Updates dependency versions across Go modules, Docker base images, service images, and GitHub Actions to their latest stable releases.

Kept at current versions (already latest major):

• actions/checkout@v4, actions/cache@v4, docker/login-action@v3
• go-redis/redis/v8, gorilla/mux, packageurl-go, yaml.v3 (no newer minor/patch within same major)

Review & Testing Checklist for Human

• Verify Go 1.26 compatibility: Go 1.26.0 was released on Feb 10, 2026 (2 days ago). Confirm you're comfortable adopting it this early vs. staying on 1.25.x which has had more soak time. The toolchain directive jumped two minor versions from 1.24.3.
• Build Docker images locally: Run docker-compose build to verify both Dockerfile (golang:1.26-alpine + alpine:3.21) and ui/Dockerfile (nginx:1.28-alpine) build successfully. CI only tests the API Dockerfile build, not the UI or compose stack.
• Alpine 3.18 → 3.21 runtime jump: This skips three Alpine minor versions in the runtime stage. Verify the statically-compiled binary (CGO_ENABLED=0) runs correctly on alpine:3.21 — should be fine given static linking, but worth a quick smoke test.
• Consider go-redis v9: The go-redis/redis/v8 package was not updated. v9 exists with breaking API changes. Confirm staying on v8 is intentional.

Recommended test plan:

docker-compose build
docker-compose up -d
curl http://localhost:8080/api/config  # verify API responds
# Check UI at http://localhost:8081
docker-compose down

Notes

• All Go lint (gofmt), vet, and unit tests pass locally
• Helm chart versions (appVersion, version) were not modified as they represent application versioning, not dependencies

Requested by: @stevologic
Link to Devin run: https://app.devin.ai/sessions/22e5e532b1484522b306cc0f0e2f5dd8