Tier 1 version bumps (#186)

## Summary

Audit and upgrade of all deployed images, helm charts, and custom container Dockerfiles to latest stable versions. This PR covers Tier 1 (low-risk minor/patch bumps only).

### Upstream images
| Image | Old | New |
|-------|-----|-----|
| kube-state-metrics | v2.13.0 | v2.18.0 |
| prometheus | v3.2.1 | v3.9.1 |
| loki | 3.3.2 | 3.6.5 |
| alloy | v1.5.1 | v1.13.1 |
| tailscale (proxy + operator) | v1.92.5 | v1.94.1 |
| navidrome | :latest | v0.60.3 (pinned) |

### Helm charts
| Chart | Old | New |
|-------|-----|-----|
| CloudNativePG | v0.27.0 | v0.27.1 |
| 1Password Connect | 2.2.1 | 2.3.0 |

### Custom containers (Dockerfiles updated, images not yet tagged)
| Container | Changes | New tag |
|-----------|---------|---------|
| miniflux | 2.2.16→2.2.17 (security), alpine 3.22 | v1.1.0 |
| kubectl | v1.34.1→v1.34.4, alpine 3.22 | v1.1.0 |
| kiwix-serve | alpine 3.22 | v1.1.0 |
| nettest | alpine 3.22 | v0.14.0 |
| transmission | alpine 3.22, pkg 4.0.6-r4 | v1.1.0 |

All custom containers verified with local `dagger call build`.

### Deferred to Tier 2 (separate PRs)
- Forgejo runner 6→12 (major version scheme change)
- Docker DinD 27→29
- Grafana chart 8→11 (repo migration)
- External Secrets 1→2 (breaking changes)
- Python 3.12→3.13, Elixir 1.18→1.19, Node 22→24
- Transmission 4.0.6→4.1.0 (not in Alpine yet)

## Deployment

After merge:
1. Tag custom containers: `mise run container-tag-and-release <name> <version>` for each
2. Wait for CI builds to complete
3. `argocd app sync apps` then sync individual apps, or let ArgoCD auto-detect

Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/186

containers/kiwix-serve/Dockerfile

@@ -1,7 +1,7 @@
 # kiwix-serve container
 # Downloads pre-built binary from kiwix mirror
 
-FROM alpine:3.21
+FROM alpine:3.22
 
 ARG TARGETPLATFORM
 ARG KIWIX_VERSION=3.8.1

containers/kubectl/Dockerfile

@@ -1,10 +1,10 @@
 # Minimal kubectl container
 # Multi-arch build: downloads correct binary for target platform
 
-FROM alpine:3.21 AS downloader
+FROM alpine:3.22 AS downloader
 
 ARG TARGETARCH
-ARG KUBECTL_VERSION=v1.34.1
+ARG KUBECTL_VERSION=v1.34.4
 
 RUN apk add --no-cache curl && \
     # Detect architecture - use TARGETARCH if set, otherwise detect from uname
@@ -22,7 +22,7 @@ RUN apk add --no-cache curl && \
     curl -LO "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/${ARCH}/kubectl" && \
     chmod +x kubectl
 
-FROM alpine:3.21
+FROM alpine:3.22
 
 COPY --from=downloader /kubectl /usr/local/bin/kubectl
 

containers/miniflux/Dockerfile

@@ -1,9 +1,9 @@
 # Miniflux RSS feed reader
 # Based on upstream packaging/docker/alpine/Dockerfile
 
-ARG MINIFLUX_VERSION=2.2.16
+ARG MINIFLUX_VERSION=2.2.17
 
-FROM golang:alpine3.21 AS build
+FROM golang:alpine3.22 AS build
 
 ARG MINIFLUX_VERSION
 RUN apk add --no-cache build-base git make
@@ -15,7 +15,7 @@ RUN git clone --depth 1 --branch ${MINIFLUX_VERSION} \
 WORKDIR /go/src/app
 RUN make miniflux
 
-FROM alpine:3.21
+FROM alpine:3.22
 
 LABEL org.opencontainers.image.title=Miniflux
 LABEL org.opencontainers.image.description="Miniflux is a minimalist and opinionated feed reader"

containers/nettest/Dockerfile

@@ -4,7 +4,7 @@
 # - Docker on indri (during CI build)
 # - Minikube pods (manual testing)
 
-FROM alpine:3.21
+FROM alpine:3.22
 
 RUN apk add --no-cache \
     curl \

containers/transmission/Dockerfile

@@ -1,9 +1,9 @@
 # Transmission BitTorrent daemon
 # Simpler alternative to linuxserver image
 
-FROM alpine:3.21
+FROM alpine:3.22
 
-ARG TRANSMISSION_VERSION=4.0.6-r0
+ARG TRANSMISSION_VERSION=4.0.6-r4
 
 RUN apk add --no-cache \
     transmission-daemon=${TRANSMISSION_VERSION} \