A11: Replace pip audit with real pip-audit tool and remove error suppression

Bug: CI used 'pip audit ... || true' which:
1. Relied on pip-audit being pre-installed (not guaranteed)
2. Suppressed all errors with '|| true', hiding security issues

Fix:
- Install pip-audit explicitly in CI workflow
- Remove '|| true' to fail on security vulnerabilities
- Use requirements-lock.txt instead of requirements.txt for reproducibility
- Check both production and dev dependencies

This ensures:
- Security audit actually runs and fails on vulnerabilities
- Locked dependencies are used for consistent results
- No silent failures masking security issues

.gitea/workflows/ci.yml

@@ -68,11 +68,14 @@ jobs:
       - uses: actions/setup-python@v5
         with:
           python-version: "3.12"
-      - name: Check Python dependencies for security issues
+          cache: pip
+      - name: Install pip-audit and check dependencies
         run: |
           pip install --upgrade pip
-          pip install -r apps/api/requirements.txt
+          pip install pip-audit
-          pip audit --requirement apps/api/requirements.txt || true
+          pip-audit --requirement apps/api/requirements-lock.txt
+          # Also check dev dependencies
+          pip-audit --requirement apps/api/requirements-dev-lock.txt
 
   compose-e2e:
     runs-on: ubuntu-latest