GT AI OS Community Edition v2.0.33

Security hardening release addressing CodeQL and Dependabot alerts:

- Fix stack trace exposure in error responses
- Add SSRF protection with DNS resolution checking
- Implement proper URL hostname validation (replaces substring matching)
- Add centralized path sanitization to prevent path traversal
- Fix ReDoS vulnerability in email validation regex
- Improve HTML sanitization in validation utilities
- Fix capability wildcard matching in auth utilities
- Update glob dependency to address CVE
- Add CodeQL suppression comments for verified false positives

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

apps/tenant-app/Dockerfile.dev

@@ -0,0 +1,25 @@
+# Development Dockerfile for Tenant App
+# This is separate from production Dockerfile
+
+FROM node:18-alpine
+
+WORKDIR /app
+
+# Install dependencies for building native modules
+RUN apk add --no-cache python3 make g++ git
+
+# Copy package files from the app
+COPY package.json ./
+
+# Install dependencies (tenant-app doesn't have workspace dependencies in package.json)
+# Use --legacy-peer-deps to handle jspdf-autotable peer dependency mismatch
+RUN npm install --legacy-peer-deps
+
+# Copy application code
+COPY . .
+
+# Expose port
+EXPOSE 3000
+
+# Development command (will be overridden by docker-compose)
+CMD ["npm", "run", "dev"]