[MEDIUM] Add npm audit/Snyk dependency scanning to backend CI pipeline

[kilodesodiq-arch]

Engineering Gap

.github/workflows/backend-ci.yml has no dependency vulnerability scanning. Only the AI service CI pipeline includes security scanning (Bandit + Safety at ai-service-ci.yml). Backend npm dependencies ship to production without vulnerability checks.

Codebase Evidence

• .github/workflows/backend-ci.yml: 3 steps — checkout, install, lint, test, build. No audit/scan step.
• .github/workflows/ai-service-ci.yml lines 143-158: Security scan job with Bandit and Safety — pattern to replicate

Risk Profile

Current Risk

Vulnerable npm packages deployed to production undetected.

Business Impact

Known CVE exploitation. Supply chain attacks. Compliance violations.

Remediation Strategy

Add npm audit step to backend CI. Optionally add Snyk or Dependabot for automated PRs. Fail on critical/high vulnerabilities.

Success Conditions

• npm audit step added to backend CI
• CI fails on critical/high vulnerabilities
• Regular audit schedule configured

Change Surface

File: .github/workflows/backend-ci.yml

Security Review

Supply chain security hardening.

Completion Checklist

• Implementation completed
• Peer reviewed
• CI checks passing
• Ready for merge