Run cloudvalid.com on Node instead of Bun #53

Summary

Bun checks outbound TLS against root certificates compiled into its binary, so this app drops a distrusted root like eMudhra's (datum-cloud/infra#7423) only when Bun ships a release and we rebuild. Dependabot also cannot read Bun lock files: it sees only the direct ranges in package.json, so advisories in everything those pull in never raise an alert. cloud-portal's 23 high advisories surfaced on 2 Nov, the day it moved to Node.

The production stage of Dockerfile runs bun run ./server.mjs on oven/bun:1.3-slim, and bun.lock pins its dependencies.

Done when

• The image builds and runs on Node with npm or pnpm, with no Bun in its image, scripts, lock file or CI
• The server drains on SIGTERM and keeps idle connections open longer than Envoy's 60 second upstream idle timeout
• The repository's dependency graph lists resolved versions, not ranges

Part of datum-cloud/infra#7480