feat(images): move seven roles off the Debian codename base onto slim

A '-bookworm' tag names its Debian release by codename, which carries no
ordering, so nothing can raise it across a Debian major and the base stays
frozen on that release for as long as the pin stands. Moving to '-slim'
drops the codename and takes the smaller image at the same time.

The tag hides that this is two changes at once: node:26-slim and
python:3.x-slim are trixie today, so those six roles cross Debian 12 to 13
and lose the toolchain the full buildpack-deps image carried. node:24-slim
is still bookworm and its manifest is byte-identical to
node:24-bookworm-slim, so flowise changes nothing today; what it gains is a
tag that will follow the rebase instead of pinning Debian 12 forever.

Each image was built with --no-cache and the steps read back rather than
the exit code: postmarks installs git 2.47.3-0+deb13u1 and 304 npm
packages, bookwyrm builds through its runtime stage so the libjpeg62-turbo,
libsass1, libffi8, libxslt1.1 and libmagic1 it hardcodes do exist on
trixie, roulette-wheel compiles its webpack bundle. Two were additionally
exercised at runtime: sharp loads its prebuilt binding in the simpleicons
image, and bridgy-fed imports secp256k1 and constructs flask_app.app.
web-svc-cdn has no Dockerfile, so its build script's seven tools were
checked for presence instead.

bridgy-fed needs pkg-config, autoconf, automake and libtool to survive the
move. secp256k1 vendors libsecp256k1 and builds it from source: without
pkg-config the metadata step refuses outright, and with it autogen.sh exits
127. python:3.14-bookworm is the full buildpack-deps image and ships both;
slim does not. They land in the build stage only, so the runtime image
stays slim.

The flowise min-storage marker still claimed a bookworm-slim base and now
names what is actually built.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

roles/web-app-bookwyrm/meta/services.yml

@@ -59,7 +59,7 @@ bookwyrm:
   image: python
   # TODO: bump when upstream Bookwyrm declares support for Python >= 3.12 in requirements.txt
   # nocheck: docker-version
-  version: 3.11-bookworm
+  version: 3.11-slim
   custom: true
   repository: https://github.com/bookwyrm-social/bookwyrm.git
   ref: v0.9.3

roles/web-app-bridgy-fed/files/Dockerfile

@@ -18,7 +18,7 @@ ARG BRIDGY_REF
 
 RUN rm -rf /var/lib/apt/lists/* && \
     apt-get -o Acquire::Retries=3 update && apt-get -o Acquire::Retries=3 install -y --no-install-recommends \
-    git build-essential curl ca-certificates && \
+    git build-essential pkg-config autoconf automake libtool curl ca-certificates && \
     rm -rf /var/lib/apt/lists/*
 
 WORKDIR /app

roles/web-app-bridgy-fed/meta/services.yml

@@ -47,7 +47,7 @@ bridgy-fed:
     swarm:
       enabled: true
   image: python
-  version: 3.14-bookworm
+  version: 3.14-slim
   name: web-app-bridgy-fed
   repository: https://github.com/snarfed/bridgy-fed.git
   # nocheck: repository-version -- upstream publishes no tags, so the pin is a commit

roles/web-app-flowise/meta/services.yml

@@ -60,12 +60,12 @@ flowise:
     no_stop_required: false
   image: node
   # nocheck: docker-version
-  version: "24-bookworm-slim"
+  version: "24-slim"
   npm_version: 3.1.4
   sqlite_version: 12.11.1
   custom: true
   name: flowise
-  # nocheck: min-storage-headroom  Reason: the deployed image is built here from node:24-bookworm-slim and measures 4.8 GB, so the base image transfer is not its footprint
+  # nocheck: min-storage-headroom  Reason: the deployed image is built here from node:24-slim and measures 4.8 GB, so the base image transfer is not its footprint
   min_storage: 6GB
   cpus: "1.0"
   mem_reservation: 1g

roles/web-app-postmarks/meta/services.yml

@@ -46,7 +46,7 @@ postmarks:
     swarm:
       enabled: true
   image: node
-  version: 26-bookworm
+  version: 26-slim
   custom: true
   name: web-app-postmarks
   repository: https://github.com/ckolderup/postmarks.git

roles/web-app-roulette-wheel/meta/services.yml

@@ -31,7 +31,7 @@ roulette-wheel:
     swarm:
       enabled: true
   image: node
-  version: 26-bookworm
+  version: 26-slim
   custom: true
   repository: https://github.com/kevinveenbirkenbach/roulette-wheel.git
   ref: master

roles/web-svc-cdn/meta/services.yml

@@ -30,7 +30,7 @@ build:
   # nocheck: single-replica  one-shot npm-mirror build writing the shared served root; parallel replicas would race and duplicate work
   replicas: 1
   image: node
-  version: "26-bookworm"
+  version: "26-slim"
   cpus: "1.0"
   mem_reservation: 128m
   mem_limit: 256m

roles/web-svc-simpleicons/meta/services.yml

@@ -40,7 +40,7 @@ simpleicons:
   enabled: true
   shared: true
   image: node
-  version: 26-bookworm
+  version: 26-slim
   local_image: simpleicons-server
   local_version: latest
   min_storage: 612MB