fix: script portability and npm security updates

Scripts:
- stop.sh: replace Linux-only fuser with cross-platform lsof fallback
- start.sh: parameterize port (APP_PORT) and container name (dynamic lookup)
- app-dev-start.sh: cross-platform stat (GNU -c / BSD -f) and setpriv/su fallback
- deploy-compose.sh: parameterize Docker registry via DOCKER_REGISTRY env var
- harden-postgres.sh: make DB_USER and DB_NAME configurable via env vars

NPM security:
- next: 15.5.12 → 15.5.15 (fixes HTTP request smuggling CVE)
- nodemailer: 8.0.1 → 8.0.5 (fixes SMTP command injection CVEs)
- lodash-es: add pnpm override to force >=4.18.0 (fixes code injection + prototype pollution)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/stop.sh

@@ -16,8 +16,12 @@ if [ -f /tmp/capakraken-dev.pid ]; then
   rm -f /tmp/capakraken-dev.pid
 fi
 
-# Also kill anything on port 3100
-fuser -k 3100/tcp 2>/dev/null || true
+# Also kill anything on port 3100 (cross-platform: lsof works on Linux + macOS)
+if command -v lsof >/dev/null 2>&1; then
+  lsof -ti:3100 2>/dev/null | xargs kill 2>/dev/null || true
+elif command -v fuser >/dev/null 2>&1; then
+  fuser -k 3100/tcp 2>/dev/null || true
+fi
 
 # 2. Stop Docker services (keep data volumes)
 echo "  Stopping app, PostgreSQL and Redis..."