Add security scanning to CI pipeline

- Add pip-audit check to PR workflow (non-blocking warning)
- Add npm audit check to PR workflow (non-blocking warning)
- Create scheduled weekly security audit workflow that:
  - Runs strict pip-audit and npm audit
  - Creates/updates GitHub issues when vulnerabilities found
  - Uploads audit results as artifacts
  - Supports manual trigger via workflow_dispatch

.github/workflows/ci.yml

@@ -44,6 +44,28 @@ jobs:
       - name: Run ruff format check
         run: ruff format --check backend/
 
+  backend-security:
+    name: Backend Security
+    runs-on: ubuntu-latest
+    if: github.event_name == 'push' || github.actor != github.repository_owner
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements.txt
+          pip install pip-audit
+
+      - name: Run pip-audit
+        run: pip-audit --desc on
+
   backend-tests:
     name: Backend Tests
     runs-on: ubuntu-latest
@@ -103,6 +125,29 @@ jobs:
         working-directory: frontend
         run: npm run lint
 
+  frontend-security:
+    name: Frontend Security
+    runs-on: ubuntu-latest
+    if: github.event_name == 'push' || github.actor != github.repository_owner
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: 'npm'
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install dependencies
+        working-directory: frontend
+        run: npm ci
+
+      - name: Run npm audit
+        working-directory: frontend
+        run: npm audit --audit-level=moderate
+
   frontend-typecheck:
     name: Frontend Type Check
     runs-on: ubuntu-latest