fix: refresh vulnerable Debian codec package

Co-authored-by: jxxghp <51039935+jxxghp@users.noreply.github.com>

docker/Dockerfile

@@ -304,6 +304,8 @@ COPY --from=uv /uv /usr/local/bin/uv
 
 # 浏览器运行依赖
 RUN playwright install-deps chromium \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends libde265-0 \
     && apt-get autoremove -y \
     && apt-get clean \
     && rm -rf \

tests/test_release_supply_chain.py

@@ -126,6 +126,10 @@ def test_base_image_uses_refreshable_tag_and_apt_does_not_upgrade_in_place() ->
     assert "ARG MOVIEPILOT_PYTHON_VERSION" in free_threaded_stage
     assert 'uv python install --no-bin "${MOVIEPILOT_PYTHON_VERSION}t"' in free_threaded_stage
     assert "apt-get upgrade" not in dockerfile
+    assert (
+        "apt-get install -y --no-install-recommends libde265-0"
+        in dockerfile
+    )
     assert "\n    openssl \\\n" in dockerfile
     assert "\n    util-linux \\\n" in dockerfile