CI: dependency-vulnerability and SAST gates #146

This was generated by AI during triage.

Context

From a security audit (2026-07-22). CI runs build + test only. A manual npm audit currently reports 0 vulnerabilities across 297 dependencies, but nothing catches newly published advisories between releases, and there is no SAST. (Secret scanning is already covered externally: GitGuardian scans PRs.)

Agent Brief

Category: enhancement
Summary: Add dependency-vulnerability and static-analysis gates to the CI pipeline.

Current behavior:
The CI workflow builds the solution and runs tests. No npm audit, no dotnet list package --vulnerable, no dependency review on PRs, no SAST step.

Desired behavior:

• The web job fails on known vulnerabilities of high severity or above in production dependencies (npm audit --audit-level=high on prod deps; the implementer decides whether dev-dependency advisories warn or fail — state the choice in the workflow).
• The backend job fails when dotnet list package --vulnerable --include-transitive reports a vulnerable package (command exits 0 regardless, so the step must parse output).
• PRs get GitHub's dependency-review action (fails on newly introduced vulnerable dependencies).
• A SAST step (CodeQL default setup or Semgrep CI, implementer's choice) runs on PRs or on a schedule — advisory or blocking, stated in the workflow.
• A documented escape hatch exists for a false-positive/unfixable advisory (e.g. audit exceptions file or documented skip), so an upstream advisory can't indefinitely block unrelated PRs without a deliberate decision.

Acceptance criteria:

• CI passes on the current tree with all new gates active.
• The npm and NuGet vulnerability steps demonstrably fail on a known-vulnerable package (verified once during development, e.g. by temporarily pinning an old package on the PR branch, then reverted).
• Dependency review runs on PRs.
• SAST step present with its blocking/advisory mode stated in the workflow file.
• Escape-hatch/override path documented in the workflow or contributing docs.

Out of scope:

• Fixing any vulnerabilities the new gates surface later (file separately as they appear).
• License compliance scanning.
• Secret scanning (GitGuardian already covers PRs).
• Container image scanning.