chore(deps): update ghcr.io/pocket-id/pocket-id docker tag to v2.13.0

[renovate]

This PR contains the following updates:

Package	Update	Change
ghcr.io/pocket-id/pocket-id	minor	v2.12.0-distroless → v2.13.0-distroless

---

Release Notes

pocket-id/pocket-id (ghcr.io/pocket-id/pocket-id)

v2.13.0

Compare Source

Bug Fixes

• retry qr code login polling for known transient gateway responses (7039692 by @​stonith404)
• decrease QR code login session duration to 5 minutes (e35be30 by @​stonith404)
• show more user-friendly error message if QR code has expired (27199f6 by @​stonith404)
• one-time-access-token CLI fails with "RuntimePSKs is required" (#​1637 by @​salcatroppa)
• session revoke fails if orphaned session tokens exist (598895e by @​stonith404)
• disable api key auth for webauthn register endpoints (db64b15 by @​stonith404)
• explicitly set SameSite to Lax for cookies (69d55ad by @​stonith404)
• explicitly require JSON for request bodies (1238bf0 by @​stonith404)
• don't rely on content length header for optional json binding (2c7d1b6 by @​stonith404)
• respect log level in HTTP request logs (488c50e by @​stonith404)
• don't skip rate limits for loopback addresses (140b5d3 by @​stonith404)
• make OIDC client token lifetimes optional (#​1650 by @​ItalyPaleAle)
• in non-HA mode, increase AlarmLeaseDuration (#​1660 by @​ItalyPaleAle)
• separate TLS inputs and preserve certificate reloads (#​1653 by @​stonith404)
• brotli compression ignored (#​1661 by @​stonith404)
• align last signed in text left (c87012a by @​stonith404)

Features

• make oauth access tokens RFC 9068 compliant (7c55bdf by @​stonith404)
• implement OAuth Client ID Metadata Document (#​1526 by @​jfroy)
• add ability to customize session duration of clients (#​1641 by @​stonith404)
• add observability to actors (#​1646 by @​ItalyPaleAle)
• include Francis data in Pocket ID backups (#​1645 by @​ItalyPaleAle)
• add settings for limiting what passkeys can be used (#​1662 by @​stonith404)

Other

• preserve tab indentation for package.json in release script (a1ebf4e by @​stonith404)
• Bump the "all-dependencies" group with 3 updates across multiple ecosystems (#​1639 by @​dependabot[bot])
• use paraglide markup instead of custom implementation (b08ac7b by @​stonith404)
• fix wrong database version in database.json (281bea5 by @​stonith404)
• standardize API error handling (#​1635 by @​stonith404)
• add deepsec to gitignore (e3e0ddc by @​stonith404)
• upgrade vulnerable dependencies (9320144 by @​stonith404)
• remove unused curl dependency from Dockerfile (98160b2 by @​stonith404)
• remove invalid unit test (95809dd by @​stonith404)
• use smaller francis.bin (4fe6f06 by @​stonith404)
• move GeoLite to its own package (#​1647 by @​ItalyPaleAle)
• fix formatting (#​1666 by @​Copilot)

Full Changelog: pocket-id/pocket-id@v2.12.0...v2.13.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.