Add dependency vulnerability scanning to CI

[garland3]

Summary

• Adds a new GitHub Actions workflow (dependency-scan.yml) that audits both Python and Node dependencies for known vulnerabilities
• Python job uses pip-audit --strict --desc against the uv-managed dependency set
• Node job uses npm audit --audit-level=high against frontend dependencies
• Runs on push to main, PRs to main, and on a weekly Monday cron schedule to catch newly disclosed CVEs

Test plan

• Verify the workflow appears in the Actions tab after merge
• Confirm the Python audit job installs dependencies via uv and runs pip-audit successfully
• Confirm the Node audit job runs npm audit against frontend dependencies
• Trigger a manual workflow run or open a test PR to validate both jobs execute and report results
• Verify the weekly cron schedule is registered correctly

[Copilot]

Pull request overview

Adds a dedicated GitHub Actions workflow to run dependency vulnerability audits for both the Python (uv-managed) and frontend Node.js dependency sets, intended to run on main/PRs and on a weekly schedule.

Changes:

• Introduces .github/workflows/dependency-scan.yml with separate Python and Node audit jobs.
• Python job runs pip-audit after installing dependencies via uv.
• Node job runs npm audit after npm ci in frontend/.

[Copilot]

This repository already has a scheduled dependency/security scanning workflow in .github/workflows/container-scan-trivy.yml (includes a dependency-scan job and a Monday cron). Adding a separate dependency-scan.yml will duplicate scheduled runs and can create conflicting/noisy CI signals. Consider folding pip-audit/npm-audit into the existing security workflow (or removing the older job) so there is a single source of truth for dependency scanning.

Suggested change

	schedule:
	# Run weekly on Monday at 06:00 UTC
	- cron: "0 6 * * 1"

[Copilot]

uv sync --frozen suggests the environment should exactly match the lockfile, but the subsequent uv pip install pip-audit mutates the environment outside the lock. Prefer running pip-audit as an isolated tool (e.g., via uv tool run ...) or pin/lock pip-audit as a dependency group so the audit environment stays reproducible.

Suggested change

	- name: Install pip-audit
	run: uv pip install pip-audit
	- name: Run pip-audit
	run: uv run pip-audit --strict --desc
	- name: Run pip-audit
	run: uv tool run pip-audit --strict --desc

[Copilot]

Node is set to 22 here, but other CI workflows in this repo use Node 18 (e.g. .github/workflows/docker-image.yml and codeql-analysis.yml). Using a newer major Node version just for npm ci/npm audit can cause inconsistent results or install failures if the lockfile/tooling was generated against Node 18. Consider aligning this to the same Node version used elsewhere (or centralizing the version via a single file/env var).

Suggested change

	node-version: "22"
	node-version: "18"

[garland3]

Closing in favor of including this workflow in PR #79, which consolidates all pending changes.