[Security & ops] Add npm audit / dependency vulnerability check to CI

[chillwur]

Description

Catch known-vulnerable dependencies before they reach main, especially important given this service handles custodial private keys.

Deliverables

• CI step running npm audit --audit-level=high (or equivalent) and failing the build on high/critical findings

Depends on

None