Added .gitea/workflows/ci.yml which runs 'npm audit --audit-level=moderate' on every push and PR. Fails the build on any moderate or higher severity finding. Also added 'npm run audit' and 'npm run audit:fix' convenience scripts to package.json for local use.