Miniflux 2.2.19 + container.py migration + ty typechecker (#331)

## Summary

- Upgrade miniflux from 2.2.17 to 2.2.19 (security hardening, performance improvements)
- Migrate miniflux from Dockerfile to native Dagger container.py build
- Refactor `alpine_runtime()` helper to support existing users (nobody/65534)
- Add `ty` (Astral) Python typechecker to prek hooks

## Test plan

- [ ] `dagger call build --src=. --container-name=miniflux` succeeds
- [ ] `dagger call container-version --container-name=miniflux` returns 2.2.19
- [ ] `mise run container-version-check` passes
- [ ] `ty check` passes cleanly
- [ ] `prek run --all-files` passes
- [ ] CI builds container successfully
- [ ] Miniflux healthcheck passes after deploy from branch

Reviewed-on: #331

mise-tasks/service-review

@@ -5,7 +5,7 @@
 # ///
 #MISE description="Review the most stale service for version freshness"
 #USAGE flag "--limit <limit>" default="15" help="Number of services to show in the table"
-#USAGE flag "--type <type>" help="Filter by service type (argocd, ansible, nixos)"
+#USAGE flag "--type <type>" help="Filter by service type (argocd, ansible, nixos, fly, mise)"
 """Review the most stale service for version freshness.
 
 Reads ``docs/reference/services/service-versions.yaml`` and sorts services
@@ -197,6 +197,13 @@ def main(
             "• Update: dagger call flake-update --src=. export --path=nixos/ringtail/flake.lock\n",
             "• Deploy: mise run provision-ringtail\n",
         ]
+    elif svc_type == "mise":
+        checklist_parts += [
+            "\n[bold]Mise Tool Update:[/bold]\n",
+            "• Update pinned version in mise.toml\n",
+            "• Run: mise install to verify\n",
+            "• Check for breaking changes in release notes\n",
+        ]
 
     checklist_parts += [
         "\n[bold]Health Check:[/bold]\n",