pin axios to known-safe version

[vigneshrajsb]

What changed

• pin the direct axios dependency to 0.30.0 instead of allowing ^0.30.0
• update the lockfile specifier to match the pinned dependency
• require pnpm install --frozen-lockfile in the Docker build paths that install app dependencies

Why

Socket reported a supply-chain compromise affecting axios@0.30.4 and axios@1.14.1 on March 31, 2026:
https://socket.dev/blog/axios-npm-package-compromised

This repo's checked-in lockfile was already on axios@0.30.0, but the semver range still allowed a future re-resolve to the compromised 0.30.4 release. The Dockerfiles also allowed non-frozen installs, which could refresh the lock during image builds.

Impact

• keeps the repo on the known-safe locked axios version
• prevents Docker builds from drifting away from the checked-in lockfile
• leaves unrelated local work untouched

Validation

• pnpm install --frozen-lockfile --ignore-scripts