Pin all container images and versions

Several images float on moving tags, so builds aren't reproducible and can break overnight when upstream publishes something new.

• postgres:15 -> a pinned postgres:15.x-alpine in docker-compose
• nginx:alpine -> a pinned 1.2x version in the frontend Dockerfile (until the Start migration replaces it)
• Anything the API image work didn't already pin (dev Dockerfiles currently use node:latest)
• Renovate or a note in the README for how versions get bumped deliberately