Formally reconcile SECURITY_AUDIT.md findings into tracked GitHub issues

[phertyameen]

Location

SECURITY_AUDIT.md

Problem

A SECURITY_AUDIT.md file exists in the repo, but it's not confirmed whether every finding in it has a corresponding open GitHub issue actively tracking remediation, risking audit findings quietly going stale in a document nobody revisits.

Acceptance Criteria

• Every open finding in SECURITY_AUDIT.md cross-referenced with an issue number, filing new issues for any that lack one
• Closed/remediated findings clearly marked as such in the document
• A documented process established for keeping this reconciled going forward as new audit findings are added