Fix high/critical audit findings and add CI dependency-audit gate

[torreyatcitty]

Summary

Security team requirement: dependency audits at the high level must pass in CI. This PR fixes the fixable high/critical findings (audit was 5 high + 4 critical) and adds the gate.

Dependency fixes

• http-proxy-middleware ^1.0.3 → ^3.0.6 (high, GHSA-c7qv-q95q-8v27). Nothing in scripts/config imports it directly, and the existing resolutions entry already forced every nested copy to 3.0.7 — yarn 1 resolutions just don't apply to direct deps, so the direct dependency was stuck at vulnerable 1.3.1. This aligns it with what already runs.
• websocket-driver → ^0.7.5 via resolutions (critical, GHSA-xv26-6w52-cph6, via webpack-dev-server → sockjs). Patch-level bump, same pattern as the existing resolutions. (Supersedes the open dependabot branch for the same advisory.)

Full production yarn build passes after the upgrades.

Allowlisted advisories (cannot be fixed by upgrade)

Documented with justifications in scripts/audit-allowlist.json; printed in every CI run:

• GHSA-v7cw-rxgx-j29p, compound-components "malware" (critical) — false positive. Our dependency is a pinned-commit git URL to Compound-Foundation/compound-components; the advisory targets a name-squatted package on the public npm registry, and yarn audit matches by name only. ⚠️ The squatting itself is worth reporting to the security team as a dependency-confusion attempt.
• GHSA-2p57-rm9w-gvfp, ip SSRF (high) — no patched release of ip exists (the advisory covers every version). Dev-only via webpack-dev-server v3's local dev server; not in the production build. Goes away entirely if/when webpack-dev-server is upgraded to v4+ (which dropped ip), noted in the allowlist entry.

CI gate

• .github/workflows/audit.yml — checkout + node, then node scripts/audit-check.js. No yarn install needed (audit runs off the lockfile), so the job takes seconds.
• scripts/audit-check.js — parses yarn audit --json and fails on any non-allowlisted high/critical advisory. A wrapper is required because yarn 1's --level high only filters the printed report; its exit code still reflects low/moderate findings (this repo has ~180, which the gate intentionally ignores).

Test plan

• yarn build (production build) passes with the upgraded dependencies
• node scripts/audit-check.js exits 0, printing the two allowlisted advisories with justifications
• Failure path: with the allowlist removed, exits 1 listing both advisories
• Dependency Audit workflow green on this PR

🤖 Generated with Claude Code