Security & quality: patch deps, add CodeQL + Dependabot, harden Actions

[davide-pi]

Addresses the repository's Security & Quality setup, in four parts.

1. Fix open Dependabot alerts (package-lock.json)

npm audit fix — bumps within existing semver ranges, lockfile only, no package.json change:

Package	→ version	Severity	Advisory
postcss	8.5.25	High	GHSA-r28c-9q8g-f849 (source-map path traversal)
brace-expansion	1.1.18 / 2.1.4	High	ReDoS / OOM DoS
ajv	6.15.0	Moderate	ReDoS with $data
dompurify	3.4.12	Low	GHSA-c2j3-45gr-mqc4 (custom-element bypass)

Closes the 4 open alerts. Lint + build verified green.

Note on npm audit noise: after the fix, npm audit reports ~11 "high" findings for minimatch/eslint/typescript-eslint. These are a false positive — the installed brace-expansion (1.1.18 / 2.1.4) is already ≥ the patched versions; npm's synthetic advisory range (<=5.0.7) over-matches and proposes a spurious eslint@10 major bump. Dependabot uses exact version matching and will not flag these. Not chased here (it would be a breaking devDependency upgrade).

2. CodeQL code scanning (.github/workflows/codeql.yml)

Advanced setup with the security-and-quality query suite for JavaScript/TypeScript, on push, PR, and a weekly schedule.

⚠️ Uses code scanning advanced setup. If "Default setup" is later enabled in repo settings it will conflict — keep code scanning on the workflow, not both.

3. Dependabot version updates (.github/dependabot.yml)

Weekly updates for npm and github-actions, grouped to reduce PR noise (npm minor/patch grouped; majors individual). Complements the automatic security updates already running.

4. Harden the Actions workflow (build-and-deploy.yml)

• Per-job timeout-minutes and least-privilege permissions on the deploy jobs.
• Actions pinned to version tags (@v4, @v3, @v3.2.1) for readability; Dependabot (part 3) tracks updates. (Full commit-SHA pinning was considered for stronger supply-chain protection but tags were preferred.)

Coordination note

This branch is cut from main, so it does not include the cleanup job from PR #15. Both PRs touch build-and-deploy.yml but in disjoint regions (this PR: lint/build/deploy-*; #15: an appended cleanup job), so they should merge without conflict in either order.

🤖 Opened with Claude Code

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.