build: switch to native Hugo TailwindCSS pipeline, align Dockerfile with pivoine.art

Replaces the PostCSS + autoprefixer toolchain with Hugo's native
css.TailwindCSS pipe (via @tailwindcss/cli), matching the setup already
in use on pivoine.art. Dockerfile now builds on hugomods/hugo with a
matched Hugo/Node version instead of manually installing Hugo onto
node:22-alpine.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S3xLyuoN6uzfCYBo8kVoSn

hugo.toml

@@ -36,6 +36,9 @@ noClasses = true
 [build]
 writeStats = true
 
+[security.exec]
+allow = ['^(dart-)?sass$', '^go$', '^git$', '^node$', '^npx$', '^tailwindcss$']
+
 [[menus.footer]]
 name = "Imprint"
 url = "/imprint/"