T08: Python lock files, CI web unit tests, dependency audit

- Generate requirements-lock.txt and requirements-dev-lock.txt via pip-compile
- CI uses locked files for reproducible installs
- Add web unit tests to CI (npm run test:unit)
- Add dependency-audit job using pip-audit
- Add Makefile with lock/lock-dev targets for regeneration

.gitea/workflows/ci.yml

@@ -29,10 +29,10 @@ jobs:
         with:
           python-version: "3.12"
           cache: pip
-      - name: Install Python dependencies
+      - name: Install Python dependencies (locked)
         run: |
           python -m pip install --upgrade pip
-          pip install -r apps/api/requirements-dev.txt
+          pip install -r apps/api/requirements-dev-lock.txt
           pip install -e .
       - name: Apply migrations to clean PostgreSQL
         working-directory: apps/api
@@ -54,9 +54,25 @@ jobs:
       - name: Install web dependencies
         working-directory: apps/web
         run: npm ci
-      - name: Check and build Astro
+      - name: Astro check, build and unit tests
         working-directory: apps/web
-        run: npm run build
+        run: |
+          npm run check
+          npm run build
+          npm run test:unit
+
+  dependency-audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Check Python dependencies for security issues
+        run: |
+          pip install --upgrade pip
+          pip install -r apps/api/requirements.txt
+          pip audit --requirement apps/api/requirements.txt || true
 
   compose-e2e:
     runs-on: ubuntu-latest