🔒️(backend) prevent automatic upgrade setuptools

The latest `setuptools` version pulls in a `jaraco.context` version that
triggers a Trivy scan failure. `jaraco.context` has a path traversal
vulnerability.

This fix is inspired by suitenumerique/people, specifically Marie’s PR #1010.

CHANGELOG.md

@@ -8,8 +8,11 @@ and this project adheres to
 
 ## [Unreleased]
 
-## [1.3.0] - 2026-01-13
+### Fixed
 
+🔒(backend) prevent automatic upgrade setuptools
+
+## [1.3.0] - 2026-01-13
 
 ### Added
 

Dockerfile

@@ -4,7 +4,7 @@
 FROM python:3.13.5-alpine3.21 AS base
 
 # Upgrade pip to its latest release to speed up dependencies installation
-RUN python -m pip install --upgrade pip setuptools
+RUN python -m pip install --upgrade pip
 
 # Upgrade system packages to install security updates
 RUN apk update && \