feat(security): comprehensive security audit and dependency hardening

[PAMulligan]

Summary

• Fix dependency vulnerabilities: Updated vitest to 4.1.2, resolving 2 picomatch vulnerabilities (1 high ReDoS, 1 moderate method injection)
• Add Snyk CI scanning: New security-scan job runs pnpm audit, Snyk vulnerability scanning, and anti-pattern checks on every push/PR
• Create input sanitization library: scripts/lib/sanitize.js with URL, path, HTML, shell arg, and JSON sanitization to prevent SSRF, XSS, command injection, and prototype pollution
• Add CSP headers configuration: templates/shared/security-headers.config.js with ready-to-use configs for Next.js, Vite/Express, and Helmet.js
• Security documentation: Comprehensive best practices guide covering dependencies, input validation, CSP, auth, API security, and CI/CD

Test plan

• pnpm audit reports no known vulnerabilities
• ./scripts/check-security.sh passes all checks
• CI security-scan job runs successfully (requires SNYK_TOKEN secret)
• Verify CSP headers config integrates with Next.js/Vite projects

Files changed

File	Purpose
.github/workflows/ci.yml	Added security-scan job with Snyk
.claude/pipeline.config.json	Enhanced security configuration
.snyk	Snyk policy file
scripts/lib/sanitize.js	Input sanitization utilities
templates/shared/security-headers.config.js	CSP and security headers
docs/security/SECURITY-BEST-PRACTICES.md	Security documentation
package.json / pnpm-lock.yaml	vitest update

Closes #20

🤖 Generated with Claude Code