Remove axios from the realtime server dependencies to avoid header injection risk,
switch Docker builds to npm ci, and bump the realtime image version to 1.0.15.
The production Dockerfile already runs apk upgrade at build time.
The helper and realtime Dockerfiles were missing this step.
The helper (Alpine 3.21) ships with CVE-2025-15467 in OpenSSL 3.3.5.
The realtime (Alpine 3.18) has outdated OpenSSL 3.1.2 with HIGH CVEs.
Adding apk upgrade before apk add makes both images consistent
with the production Dockerfile.
