ci: add npm dependency audit for high/critical vulnerabilities

[LucasSantana-Dev]

Problem

.github/workflows/validate.yml runs semgrep (static analysis) and trufflehog (secret scan) but has no dependency vulnerability scan. High/critical CVEs in CLI or web dependencies would not be caught in CI.

Acceptance criteria

• New job dep-audit in validate.yml
• Runs npm audit --audit-level=high (or pnpm audit)
• Fails PR if high or critical vulnerabilities found
• Allow-list file (.nsprc or audit-ci.json) for known false positives

backlog: 2026-06-24 | ROI: 1.0 | effort: s