Drop compromised eMudhra roots from the image CA store (#13)

This app does not depend on `certifi`. Python still uses the image trust store for outbound TLS, and `python:3.12-slim` does not yet install the patched `ca-certificates` package.

The image install now upgrades `ca-certificates` and regenerates the bundle so `emSign ECC Root CA - G3` and `Comodo AAA Services` are not trusted.

Merge this, then redeploy beta and prod.

Reviewed-on: #13

Dockerfile

@@ -9,7 +9,8 @@ ENV PYTHONDONTWRITEBYTECODE=1 \
 WORKDIR /app
 
 RUN apt-get update \
-    && apt-get install -y --no-install-recommends libpq5 \
+    && apt-get install -y --no-install-recommends ca-certificates libpq5 \
+    && update-ca-certificates \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv