Add security audit CI gate

[jurei733]

Summary

• add a dedicated security-audit GitHub Actions job
• fail the security gate on high or critical production dependency findings
• document the audit command and CI gate in the README

Validation

• npm audit --omit=dev --audit-level=high -> found 0 vulnerabilities
• npm run lint -> exit code 0, existing max-len warning remains
• npm run test:coverage -> 261 + 6 specs successful

Completes #149