[vitormattos]

Summary

• Update pinned Nginx to 1.31.8-alpine3.24 and upgrade Alpine brotli-libs to the fixed 1.2.1-r0 (CVE-2026-111497).
• Update the pinned PHP 8.3.36 fpm-trixie digest to the upstream index already proposed by chore(deps): update php:8.3.36-fpm-trixie docker digest to 7c6bba2 #61 and explicitly refresh Debian linux-libc-dev from the security repository (CVE-2026-99083; fixed package 6.12.115-2 observed in Debian security repository).
• Preserve NFS-e module boundaries and Core version; no app, database or migration changes. Do not weaken Trivy.

Verification

• Built Nginx image in disposable Docker build; nginx -t passed and installed brotli-libs-1.2.1-r0 verified.
• Checked current PHP digest and Debian package candidate; pinned PHP source contains linux-libc-dev 6.12.113-1, and Debian security supplies 6.12.115-2.
• GitHub Actions on initial Nginx-only commit found critical CVE-2026-99083 in PHP, motivating the second signed fix. Require a green Trivy scan and integration/build jobs on the latest commit before merging.

Integration order

This combined security PR supersedes the exact PHP digest-only change in #61 once merged. Re-run remaining dependency PRs (#49, #62, #63, #64) against the updated base. #60 (Akaunting Core 3.3.0) remains blocked on fiscal/API contracts.

Both commits are DCO-compliant and GPG verified. No merge or production deploy has been performed.