ci(security): add npm audit and dependency review jobs

[yunus-dev-codecrafter]

closes #349

Summary

Add a dependency audit and review job to the CI workflow:

• dependency-audit job — runs npm audit --json via scripts/audit-deps.js, filters results through a documented, time-boxed allowlist (.audit-allowlist.json), and fails the build only on high/critical findings that aren't allowlisted.
• dependency-review job — uses actions/dependency-review-action@v4 on pull requests to flag newly introduced vulnerable packages.
• Allowlist mechanism — .audit-allowlist.json at the project root supports entries with { id, reason, expires }. Expired entries are automatically ignored. Enables temporary suppression of advisories with no available fix.
• src/ci/audit.ts — core module with loadAllowlist, parseAuditOutput, filterVulnerabilities, runNpmAudit, and checkDependencies (100% statement/line coverage, 98.14% branch coverage).
• docs/CI.md — updated with documentation for all new jobs, allowlist format, and local audit usage.

Related Issue

Closes #349

Validation

• npm run build
• npm run lint
• npm test

Checklist

• I kept the change focused on the linked issue.
• I added or updated tests for behavior changes.
• I updated documentation when commands, API behavior, or setup changed.
• I did not commit secrets, tokens, .env files, or private credentials.

Security Notes

• npm audit --json output is parsed and filtered locally; no data is sent to external services.
• actions/dependency-review-action@v4 runs only on PRs and requires contents: read + pull-requests: write permissions to post PR comments. The fail-on-severity: high setting prevents new high-severity dependencies from being merged.
• The allowlist (src/ci/audit.ts → loadAllowlist) validates every entry has a string id field and a non-empty id. Expired entries are automatically discarded, preventing stale allowlist entries from silently suppressing vulnerabilities.
• The scripts/audit-deps.js script runs in CI via node and uses ts-node for TypeScript transpilation (already a transitive dev dependency). No new runtime dependencies are introduced.

[mikewheeleer]

really nice — thanks for picking it up 🙌