Content service image: its packages at the root package.json's versions

The image pinned express@5.2.1 in its own RUN line, where Dependabot does
not reach: #698 moves the root to 5.3.0, and the image would have stayed
behind, running a version nothing here tested. It reads the versions from
the root package.json now, as the render image does, and fails naming a
package the root no longer has.

On beta: the image installs express 5.3.0 and neo4j-driver 6.2.0 (the
lockfile's); 68 search answers identical before and after.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: adamjohnwright

deploy/content-node/Dockerfile

@@ -7,9 +7,28 @@ FROM node:24
 
 WORKDIR /content-node
 
-# Only what the service imports. The repository's own lockfile would drag in
-# Angular, Playwright and the CMS to run two endpoints.
-RUN npm install --omit=dev --no-audit --no-fund neo4j-driver@^6.2.0 express@5.2.1
+# Only what the service imports, at the versions the root package.json pins,
+# read from it rather than restated here (as the render service does). The
+# repository's own lockfile would drag in Angular, Playwright and the CMS to
+# run two packages. A pin restated here stayed at express 5.2.1 when
+# Dependabot moved the root to 5.3.0 (it watches only the root), so the image
+# would have run a version nothing here tested.
+COPY package.json ./root-package.json
+RUN node -e " \
+      const root = require('./root-package.json'); \
+      const dependencies = {}; \
+      for (const name of ['express', 'neo4j-driver']) { \
+        const version = (root.dependencies ?? {})[name]; \
+        if (!version) throw new Error(name + ' is not a dependency of the root package'); \
+        dependencies[name] = version; \
+      } \
+      require('node:fs').writeFileSync('package.json', JSON.stringify({ \
+        name: 'reactome-content-node', private: true, dependencies \
+      }, null, 2)); \
+    " \
+    && npm install --omit=dev --no-audit --no-fund \
+    && npm cache clean --force \
+    && rm root-package.json
 
 COPY tools/content-node/ ./tools/content-node/
 # The nearest package.json is what tells Node a .ts module is a module (spec