pg-base backup image pins postgresql-client-16 — bump to 18 and add --no-install-recommends

docker/pg-base exists solely to carry pg_dump for backup jobs. Two issues with its install line:

1. Version pin is a latent backup-breaker. pg_dump can dump servers older or equal to its own major, and refuses newer ones. Current production RDS (surveyed 2026-07-29 across us-east-1, ca-central-1, eu-central-1, ap-southeast-2 with the cloud profile) runs PostgreSQL 15.15–15.17, so client-16 works today — but the rest of the repo (dev image, java-base, main image, all compose stacks) is already on PG18, and the day any backed-up database upgrades past 16, dumps hard-fail. Bumping to postgresql-client-18 is strictly safe (dumps ≤18) and future-proofs the image.

2. Missing --no-install-recommends — the one apt install in shipped Dockerfiles still lacking it (same recommends-chain exposure class as #36806, which broke a release build).

Side observation for the platform team: dev/test stacks run PG18 while all prod databases run 15.x — a three-major parity gap worth its own discussion.

Fix: apt install -y --no-install-recommends postgresql-client-18.

Start in docker/pg-base and locate the Dockerfile install line for the PostgreSQL client. Update the package and apt options as specified, then build the pg-base image and confirm the backup image uses the intended client version without recommended packages.