feat: add Security Auditor agent

[unmalnickname]

Summary

Adds a new Security Auditor agent persona to the Reversa framework. This is an independent agent (like Visor, Data Master, or Design System) that performs static security analysis of legacy codebases.

What it covers

Section	Description
SCA (Software Composition Analysis)	CVE scanning of dependencies from Scout's dependencies.md
Secrets scan	Hardcoded API keys, passwords, tokens, private keys in source/config/git history
Auth audit	Password storage, JWT/session handling, brute force protection, MFA, RBAC verification
Input validation	SQL injection, XSS, command injection, path traversal, insecure deserialization, SSTI
Crypto review	Algorithm choice, custom crypto (red flag), HTTPS/TLS, secret storage
Session management	Token expiration/rotation, cookie flags, CSRF, session fixation
API security	Auth coverage, rate limiting, CORS, mass assignment
OWASP Top 10	Map all findings to OWASP 2021 categories

Files changed

File	Change
agents/reversa-security-auditor/SKILL.md	New — full persona (156 lines, 8KB)
lib/installer/prompts.js	+1 line — added to OPTIONAL_AGENTS (checked by default)
lib/commands/add-agent.js	+1 line — added to AGENT_LABELS
templates/plan.md	+1 line — added as Independent Agent

Design decisions

• Phase: independente — runs after Scout (for dependencies) and Detective (for permissions matrix), but can execute at any time
• Confidence scale uses the same 🟢/🟡/🔴 system as all other agents
• Outputs go to _reversa_sdd/security/ — audit.md, secrets-scan.md, vulnerabilities.md (conditional by doc_level)
• Static analysis only — never executes the system. All findings are code-based or inferred from patterns

Output structure

_reversa_sdd/security/
├── audit.md              # Full audit report per section (always)
├── secrets-scan.md       # Hardcoded secrets with file:line references (always)
└── vulnerabilities.md    # CVE analysis + prioritized remediation (completo/detalhado)

Testing

• Verified agent directory structure matches existing pattern
• Validated integration with npx reversa install and npx reversa add-agent
• Confirmed SKILL.md frontmatter follows the existing metadata convention

Closes #new-agent-security-auditor