The Python and Node base images are past end of life

`python:3.8-slim-bullseye` — Python 3.8 reached **EOL in October 2024**, and it contradicts `pyproject.toml` (`target-version = "py310"`) and both CI jobs, which pin 3.10. Lint and tests validate 3.10 semantics against a 3.8 runtime.

`node:stretch-slim` is far worse: Debian **stretch reached EOL in June 2022**, and the stretch Node images stopped at Node 12 (EOL April 2022).

The Django image is also single-stage and keeps `build-essential`, `gcc`, `python3-dev` (~200 MB of toolchain) in the final layer, plus `libcairo2`, `libgdk-pixbuf2.0-0`, `libpango`, `poppler-utils` (~120 MB) for a PDF/SVG renderer that **does not exist** — grep for `pdftoppm|poppler|cairo|weasyprint` across all Python returns zero hits.

**Fix:** multi-stage build wheels in a builder stage, `COPY --from=builder` into a clean `python:3.11-slim-bookworm`; keep only `libpq5` and `file` at runtime; drop the cairo/pango stack; `node:20-bookworm-slim`.

---

**Evidence**

```
django/Dockerfile:1,9-15; next/Dockerfile:1
```

- Verified against: `origin/master 44ca47e (2026-07-25)`
- Verdict: **CONFIRMED**

Start with django/Dockerfile and next/Dockerfile, then compare their base images with pyproject.toml and the two CI jobs. Verify the existing dependency and renderer usage with the issue's grep targets, build the updated images, and confirm the final Django image retains only the stated runtime packages while Node uses the requested base image.

Written by the indexing model from the issue text.