fix(mono-base): install ca-certificates in runtime stage

@livekit/rtc-node (Rust + rustls + rustls-native-certs) reads root CAs
only from the system trust store. node:22-slim ships without
ca-certificates, so without /etc/ssl/certs/ca-certificates.crt every TLS
handshake from native bindings fails with
"invalid peer certificate: UnknownIssuer" — even for a valid LE chain.
Node.js itself is unaffected (own embedded CA bundle).

Incident 2026-05-21: secretary in dicoop/coopback:v2026.5.21-2 could not
connect to wss://chatcooprtc.coopenomics.world (controller logs full of
SecretaryAgentService UnknownIssuer; nginx on api-prod never saw the
handshake — broken before HTTP upgrade). Hot-fix on
voskhod-coopback-blue (docker cp ca-certificates.crt + restart)
restored secretary connectivity; this commit makes the fix permanent
in the base image so every consumer of dicoop/mono-base
(coopback / desktop / cooparser / notifications / boot) inherits it
on the next release tag.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Dockerfile

@@ -83,12 +83,23 @@ WORKDIR /app
 # ссылка на системный интерпретатор; без него `weasyprint` падает с
 # `python: not found`. `procps`/`wget` — для дебага/healthcheck'ов
 # из docker-compose.
+#
+# `ca-certificates` обязателен: node:22-slim его не содержит, а
+# native-биндинги типа @livekit/rtc-node (Rust + rustls + rustls-native-certs)
+# читают корни ТОЛЬКО из системного store. Без файла
+# /etc/ssl/certs/ca-certificates.crt любой TLS handshake из такого
+# биндинга падает с "invalid peer certificate: UnknownIssuer" —
+# даже для валидной LE-цепочки (Node-стек при этом работает,
+# у него свои вшитые корни). Инцидент 2026-05-21: secretary в
+# coopback не мог подключиться к wss://chatcooprtc.coopenomics.world.
 RUN apt-get update && apt-get install -y --no-install-recommends \
+      ca-certificates \
       python3 \
       libpango-1.0-0 libpangoft2-1.0-0 libpangocairo-1.0-0 libcairo2 \
       libffi8 libjpeg62-turbo libopenjp2-7 zlib1g shared-mime-info \
       procps wget \
- && rm -rf /var/lib/apt/lists/*
+ && rm -rf /var/lib/apt/lists/* \
+ && update-ca-certificates
 
 # Python venv с WeasyPrint, готовый к использованию.
 COPY --from=builder /venv /venv