CertScope: update dependencies and deployment and CI (+2 areas)

Public changes compared with the previous published export:
4 files changed.

Affected areas:
- dependencies: 1 file
- deployment and CI: 1 file
- documentation: 1 file
- scripts: 1 file

Changed files:
- Added: ".gitea/workflows/ci.yml"
- Updated: "SECURITY.md"
- Updated: "package-lock.json"
- Added: "scripts/audit-dependencies.mjs"

Export provenance/manifests refreshed; excluded from the change summary.

Publish curated CertScope source from 9cd536d4e2dd485794e5f5accd70220de4a081de

SECURITY.md

@@ -25,6 +25,12 @@ The HTTP diagnostics evaluate values, not just presence. HSTS requires one valid
 
 `package-lock.json` is authoritative. CI and Docker use `npm ci`, CI runs production-only and full npm audits, the production image is built and scanned for high/critical OS and library vulnerabilities, and a production CycloneDX SBOM is uploaded as a build artifact. Workflow actions are pinned to immutable commit SHAs and the Docker base is pinned to a registry manifest digest. Dependency and base-image updates are deliberate changes followed by the full validation suite.
 
+### Temporary dev-tooling advisory exception — 2026-10-05
+
+The production dependency audit remains strict and must contain no high or critical findings. The full development graph currently contains exactly one upstream advisory, `GHSA-vfj7-8cjw-p6xm`, through `eslint-config-next -> @next/eslint-plugin-next -> fast-glob -> micromatch -> braces@3.0.3`. As of 2026-10-05 upstream has not published a patched `braces` release; npm's proposed remediation is a semver-major downgrade of `eslint-config-next` to 14.2.35, which is not compatible with CertScope's reviewed Next.js 16.3.8 toolchain.
+
+CI therefore uses `scripts/audit-dependencies.mjs` as a fail-closed exception: it accepts only the exact five-node high-severity finding set, the exact advisory identifier/range, the reviewed package versions and dependency chain above. Any additional finding, changed severity/range/advisory, dependency-version drift, changed remediation, malformed audit output, or production audit finding fails CI. The exception must be removed or revised as soon as upstream publishes a compatible patched release.
+
 ## Reporting issues
 
 Do not include live credentials, private keys or confidential internal hostnames in a report. Provide a minimal reproduction using public or synthetic targets. Security fixes must preserve the public-address and redirect policy and include an offline regression test.