chore: remove libgnutls30 from Docker runtime image

[Valiunia]

Summary

Removes libgnutls30 from the node:22-slim runtime image. The package is present in the Debian slim base solely as a dependency of apt. Since apt is not needed at runtime, libgnutls30 can be force-removed after all package operations are complete without affecting the running server.

Node.js uses OpenSSL for TLS — libgnutls30 is not called by any code path in this server and was an unused transitive system dependency.

Test plan

• docker build . completes without errors; libgnutls30 removal is confirmed in build output
• Full test suite passes when run inside the built container (docker run --rm <image> sh -c "cd /app && npm test")
• MCP stdio smoke test: initialize + tools/list handshake completes; all 28 tools register correctly
• Live API calls verified against three tools inside the container: search_and_geocode_tool, reverse_geocode_tool, and directions_tool — all returned correct results

search_and_geocode_tool — forward geocode "Eiffel Tower, Paris"

{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"search_and_geocode_tool","arguments":{"q":"Eiffel Tower, Paris"}}}

Returned multiple ranked results including the Eiffel Tower in Paris, France with correct coordinates.

reverse_geocode_tool — coordinates 40.7484, -73.9857

{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"reverse_geocode_tool","arguments":{"longitude":-73.9857,"latitude":40.7484}}}

Returned:

1. 350 Fifth Avenue (350 Fifth Avenue)
   Address: 350 Fifth Avenue, New York, New York 10118, United States
   Coordinates: 40.74843, -73.985667
   Type: address

directions_tool — driving route SF → Oakland

{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"directions_tool","arguments":{"coordinates":[{"longitude":-122.4194,"latitude":37.7749},{"longitude":-122.2712,"latitude":37.8044}],"routing_profile":"mapbox/driving"}}}

Returned a route via I-80 East, duration 1522s, distance 19848m, average speed 66 kph.

Notes

libgnutls30 is removed with dpkg --remove --force-depends because apt lists it as a dependency. This is safe post-build: apt is not used at container runtime and the server has no dependency on gnutls.

[prisma-cloud-devsecops]

Prisma Cloud has found errors in this PR ⬇️

[prisma-cloud-devsecops]

perl 5.36.0-7+deb12u3 / Dockerfile.FROM

Total vulnerabilities: 3

Critical: 0	High: 3	Medium: 0	Low: 0

Vulnerability ID	Severity	CVSS	Fixed in	Status
CVE-2026-48961	HIGH	7.3	-	Open
CVE-2026-48962	HIGH	7.3	-	Open
CVE-2026-48959	HIGH	7.5	-	Open

[Valiunia]

existing issue, not induced by current PR