Audit production dependencies in pull requests

[PathGao]

Fixes #307

Adds npm audit --omit=dev directly after the locked dependency install in the PR test workflow. This rejects known runtime dependency vulnerabilities while deliberately excluding development-only findings.

The workflow behavior is covered by a regression test.

Depends on #306. Merge order: #286 → #287 → #288 → #293 → #296 → #298 → #300 → #301 → #302 → #304 → #306 → this PR.

Validated with npm ci, npm run check, npm test (136 tests), npm audit --omit=dev (0 vulnerabilities), and cargo test (21 Rust tests).

[PathGao]

@alecdotdev This follows #306 and turns its production audit result into a PR gate. It deliberately audits only runtime dependencies, so development-tooling advisories do not block application changes. Please merge after #306.