Audit and harden dependency management

[coderooz]

Status: Pending

What

Security and dependency audit:

• Run npm audit and resolve all vulnerabilities
• Add Dependabot config (already created .github/dependabot.yml — verify it works)
• Pin exact versions for production dependencies
• Review transitive dependencies for unnecessary bloat
• Add .npmrc with save-exact=true
• Verify all peerDependencies are correctly specified across workspace packages
• Check for duplicate packages in lockfile (npm ls)
• Add SECURITY.md (already created — verify content)
• Set up code scanning with CodeQL

Related: #3

[github-actions]

This issue has been automatically marked as stale because it has not had
recent activity. It will be closed in 7 days if no further activity occurs.
If you believe this is in error, please leave a comment with context.

[github-actions]

This issue was closed because it has been stale for 7 days with no
further activity. Please open a new issue if the problem persists.