[dependabot]

Bumps nginx from 1.31.0-alpine to 1.31.8-alpine.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[claude]

Review: one-line patch bump of the nginx base image (1.31.0-alpine → 1.31.8-alpine) in frontend/Dockerfile.

• Quality / correctness: Same minor line, so config and behavior compatibility risk is very low. The pinned tag keeps builds reproducible.
• Security: Patch releases usually carry security and bug fixes, so this is a good change to take.
• Performance: No impact expected.
• Tests: No code changes. CI's frontend Docker build should be enough to check it. A quick smoke test of the built image (serving the SPA, the /graphql and /ws proxy config if the image uses one) would give extra confidence.
• Changelog: Per CLAUDE.md, a fragment in changelog.d/ is optional for a dependency bump like this. Add one only if you want it recorded.

I have no blocking concerns. Approve once CI is green.