chore: security workflow (gitleaks, pip-audit, npm audit, trivy)

[constk]

Problem

Secret leaks, dep CVEs, and image CVEs all need scheduled + per-PR scanning. A single workflow keeps the scanning policy centralised and visible.

Proposed solution

Port .github/workflows/security.yml: gitleaks (binary, no SARIF upload, quota-aware), pip-audit (--strict, OSV backend, CVE ignore list with justifications), npm audit (--audit-level=high), trivy (aquasecurity/trivy-action, fails on fixable HIGH/CRITICAL). Trigger: PR + weekly schedule.

Acceptance criteria

• All four scans run on PRs and weekly via schedule.
• Trivy scans the built Docker image (depends on chore: Dockerfile (multi-stage, Python 3.14, non-root, healthcheck) #6).
• CVE ignore list lives in a versioned config file with a comment per ignore.

Priority rationale

High: secret + dep scanning is table stakes for any open-source repo with portfolio visibility.

Depends on

#9

[constk]

All three security scans green on develop: gitleaks, pip-audit, trivy. npm-audit will be re-added by #21 alongside frontend/. CVE-2026-3219 (pip 26.0.1) deferred via .github/security/pip-audit-ignore.txt with sunset note.