security: bump api_v2 to node 24.21 for OpenSSL 3.5.8

[RootUserChris]

Why

The sandbox gov-bb-api-v2 image reads NODE_VERSION=24.20.0. Node 24.20 statically links OpenSSL 3.5.7 (CVE-2026-63073 and CVE-2026-75803, both CRITICAL). node:24.21 bundles 3.5.8.

Inspector doesn't report this one: the findings come from node's C headers, which the runtime images strip. So it's tracked by hand in govtech-bb/gov-bb-security#41.

What

Both FROM lines in apps/api_v2/Dockerfile (builder and runner) move to node:24.21-alpine3.23@sha256:9ec4a2e2…. That's the same tag and digest as #2818, which does the same for apps/api and apps/form_builder_api on main. This PR targets v2-rewrite because that is the branch api_v2's deploy role trusts.

Verify after deploy

Run node -p process.versions.openssl in the new image, or read NODE_VERSION from the image config. Expect 3.5.8 / 24.21.0.

🤖 Generated with Claude Code

[github-actions]

Amplify PR previews

App	Status	URL
forms	⏭ Not affected	—
landing	⏭ Not affected	—
chat	⏭ Not affected	—
form-builder	⏭ Not affected	—
analytics	⏭ Not affected	—

Commit: 941de5a · Branches auto-delete when this PR closes.

ℹ️ feature-flagging uses a single shared preview slot at a fixed URL (preview.feature-flagging.sandbox.alpha.gov.bb) — GitHub login works, but only one FF preview exists at a time (the most recent FF PR build wins). It reads/writes sandbox flag data.

[IsaiahSama]

Approving. The change is the two FROM lines in apps/api_v2/Dockerfile (builder and runner). Both now use node:24.21-alpine3.23@sha256:9ec4a2e289874ed0d722e1772ec2de45d2801541db8612f3638b26f128c69ac2, the same tag and digest #2818 uses for apps/api and apps/form_builder_api. At this head, git grep finds no other reference to 24.20 or its digest outside those two apps, and they're #2818's job.

Non-blocking (inline): #2818 also stops deleting /usr/local/include/node now that a fixed Node is out. This PR keeps the deletion in api_v2's runner. Your call: align it here or leave it for later.

Not verified: none of this PR's checks builds the api_v2 image (the preview jobs all skipped), and I didn't build it either. Your post-deploy check (node -p process.versions.openssl → 3.5.8) is the real confirmation.

Base branch: CLAUDE.md says to open PRs against main. The description explains that api_v2's deploy role trusts v2-rewrite, so I'm not counting the base branch against this PR.

[IsaiahSama]

Non-blocking, a consistency question. #2818 makes the same bump for apps/api and apps/form_builder_api, and in the same change it stops deleting /usr/local/include/node. Its reasoning: the deletion only made sense "until node ships a fixed OpenSSL". Inspector fingerprints those headers, so keeping the deletion hides the next node-bundled OpenSSL CVE from the scanner.

This runner still deletes them (lines 64–68, just past this hunk). The comment there says "see apps/api/Dockerfile", and after #2818 that file argues the opposite. Your description also notes that Inspector can't see this CVE because the headers are stripped, which is why it's tracked by hand.

Do you want api_v2 to match #2818 here, or is this deliberately left for later? Either way is fine to merge.