fix(security): unblock v2.0.1 server release

[beyondwin]

Summary

• patch the server release image from Netty 4.2.15.Final to 4.2.16.Final
• force Jackson Core 2.x to 2.21.4 and align Jackson Core 3.x to 3.1.4
• document that v2.0.0 stopped at the Trivy gate before any production promotion or deployment
• prepare the immutable forward-fix release as v2.0.1

Verification

• dependencyInsight for Jackson and affected Netty modules
• ./scripts/server-ci-check.sh
• ./server/gradlew -p server bootJar
• local linux/arm64 release image build
• Trivy 0.70.0 HIGH/CRITICAL --ignore-unfixed gate: 0 findings
• ./scripts/pre-push-check.sh --full --release
• independent security/release contract review: no findings

Rollout

After merge and green main CI, publish v2.0.1 and deploy backend first, validate the client-contract gate, then deploy the frontend.