ci: dependency / SBOM scanning + npm audit gate

[jonmatum]

Priority: P1
Parent: #34

Context

Dependabot is active (see #33), but there is no CI step that fails a build on a known vulnerability, no SBOM generated, and no lockfile integrity check. The src/, scripts/, frontend/, and root packages each need coverage.

Requirements

npm audit gate

• CI step npm audit --audit-level=high in each of src/, scripts/, frontend/, root
• Allowlist mechanism with expiry dates (so ignored CVEs get re-reviewed)

SBOM

• Generate CycloneDX or SPDX SBOM per package on every release tag
• Upload as a release asset

Terraform / IaC scanning

• tfsec or checkov step in CI; fail on HIGH/CRITICAL
• Baseline-suppressions file committed for accepted findings

Secret scanning

• gitleaks step on PR diffs (catches .env regressions, see Tech debt and code review findings — deep audit 2026-03-23 #32 C-3)

Acceptance criteria

• A PR that adds a vulnerable dependency fails CI
• Release artifacts include an SBOM
• Terraform scan reports are clean or all findings have a dated justification

References

• Production readiness — consolidated plan (tracking) #34 (parent)
• build(deps): bump the npm_and_yarn group across 1 directory with 1 update #33 (current Dependabot PR)