Fix/ci security reliability issues

[levi0005]

Description

1. fix(ci): point API container scan at repo-root Dockerfile — .github/workflows/test.yml

Problem: The container-scanning job built docker build -t predictiq-api:${{ github.sha }} -f services/api/Dockerfile ., but services/api/Dockerfile doesn't exist anywhere in the repo — only the root Dockerfile and services/tts/Dockerfile do. The build step had continue-on-error: true, and the Trivy scan step was gated on if: success(), so the build silently failed every time and the Trivy scan for the API image never ran — yet the job reported green.
Fix: Changed the build to -f Dockerfile (repo root), and removed continue-on-error: true and the if: success() gate, so a real build failure now fails the job and Trivy always runs against a real image.

2. fix(terraform): remove timestamp() from provider default_tags — infrastructure/terraform/main.tf

Problem: The AWS provider's default_tags block included CreatedAt = timestamp(), applied to every taggable resource. Since timestamp() evaluates fresh on every plan/apply, every taggable resource showed a spurious in-place tag update on every single run, breaking the ability to get a clean terraform plan — which terraform.yml uses as a CI gate — and risking unnecessary resource churn on every deploy.
Fix: Removed the CreatedAt = timestamp() line from default_tags entirely. (Left the unrelated, legitimate timestamp() usage in modules/rds/main.tf's final-snapshot-identifier alone, since that only evaluates at destroy time, not on every plan.)

3. fix(ci): fail dependency-scan on high-severity Rust advisories — .github/workflows/dependency-scan.yml

Problem: The first cargo audit --deny warnings step for both contracts/predict-iq and services/api was marked continue-on-error: true, and the follow-up step only parsed .advisory.severity == "critical" from the JSON output and exited non-zero solely for critical findings. High-severity Rust CVEs were logged but never failed the build — inconsistent with the npm audit in the same file (fails on critical and high) and with test.yml's contracts-crate audit (no continue-on-error at all).
Fix: Removed continue-on-error: true from both initial audit steps, and extended both follow-up severity-check steps (contracts/predict-iq and services/api) to also count and fail on high-severity advisories, not just critical.

4. fix(ci): replace archived actions-rs/toolchain and actions/create-release — .github/workflows/{contract-deployment,release,test,performance}.yml

Problem: actions-rs/toolchain@v1 (used in contract-deployment.yml:35, release.yml:88, test.yml:497, performance.yml:47 and 230) and actions/create-release@v1 (contract-deployment.yml:239) both come from archived/unmaintained repos — the actions-rs org has been archived since 2021, and actions/create-release was deprecated in favor of softprops/action-gh-release, which release.yml already uses twice elsewhere in the same repo. These receive no security patches and are inconsistent with the actively-maintained dtolnay/rust-toolchain used elsewhere.
Fix: Replaced every actions-rs/toolchain@v1 occurrence with dtolnay/rust-toolchain@stable (translating profile/override/target inputs to targets/components as appropriate for each job), and replaced contract-deployment.yml's actions/create-release@v1 step with softprops/action-gh-release@v2 (translating release_name → name, keeping tag_name/body/draft/prerelease). Confirmed via grep -rn "actions-rs/toolchain|actions/create-release" .github/workflows that zero matches remain.

Type of Change

• Bug fix
• New feature
• Refactor / code cleanup
• Documentation update
• CI / tooling change
• Breaking change

Testing Done

Bundle Size

Chunk	Before	After
vendor.js
main*.js
pages/_app*.js

Checklist

• Tests pass locally
• Documentation updated (if applicable)
• No breaking changes, or breaking changes are documented above
• If you added or changed an API endpoint, regenerated the OpenAPI spec and committed the result:

  cd services/api && cargo run --bin generate-openapi > openapi.yaml
  git add openapi.yaml && git commit -m "chore: regenerate openapi.yaml"

• If you changed system architecture (new service, database, external dependency, or network boundary), updated docs/architecture.md
• Bundle size checked (if frontend changes)

Related Issues

Closes #1208
Closes #1209
Closes #1210
Closes #1211

[drips-wave]

@levi0005 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits