fix(security): add backend dependency vulnerability gate to CI

Backend CI had ruff/mypy static checks and a real pip-audit-equivalent
was missing; frontend already had npm audit, so backend was the only
side of this repo without any dependency-vulnerability gate (partial
coverage). Adds trivy-action fs scoped to backend/, HIGH/CRITICAL only,
consistent with this security programme's gate convention elsewhere.
Verified clean (0 HIGH/CRITICAL) against backend/pyproject.toml before
wiring in, so the gate does not immediately fail CI.

.gitea/workflows/ci.yml

@@ -16,6 +16,15 @@ jobs:
         run: |
           docker compose -p mobilityops-ci -f compose.yaml -f compose.test.yaml run --build --rm api ruff check app tests scripts
           docker compose -p mobilityops-ci -f compose.yaml -f compose.test.yaml run --rm api mypy app
+      - name: Backend dependency vulnerability scan (HIGH/CRITICAL)
+        uses: aquasecurity/trivy-action@0.30.0
+        with:
+          scan-type: fs
+          scan-ref: backend
+          format: table
+          severity: HIGH,CRITICAL
+          exit-code: "1"
+          ignore-unfixed: true
       - name: Remove CI stack
         if: always()
         run: docker compose -p mobilityops-ci -f compose.yaml -f compose.test.yaml down -v --remove-orphans