Security audit and dependency hardening

[PAMulligan]

Comprehensive security audit: npm audit, Snyk scanning in CI, pipeline input sanitization, CSP headers in output, and security best practices docs.