Add a dependency vulnerability scan to the CI pipeline

[jamjamgobambam]

The project has no automated check for known security vulnerabilities in its Python or JavaScript dependencies. Add a step that runs pip audit and npm audit and fails the build on high-severity findings.

Relevant files:

• .github/workflows/ci.yml

Estimated effort: 3–5 hours