Dependency vulnerability scanning gate in CI

[phertyameen]

Location

.github/workflows/

Problem

No confirmed automated vulnerability scanning (npm audit, Snyk, or GitHub's native scanning) blocks merges when a new high-severity dependency vulnerability is introduced, for a service handling financial operations this matters more than average.

Acceptance Criteria

• Scan runs on every PR, not just on a schedule
• High/critical severity findings block merge, respecting the stellar-sdk exact-pin exception documented separately
• False-positive suppression process documented, not ad-hoc