Bug: CI used 'pip audit ... || true' which:
1. Relied on pip-audit being pre-installed (not guaranteed)
2. Suppressed all errors with '|| true', hiding security issues
Fix:
- Install pip-audit explicitly in CI workflow
- Remove '|| true' to fail on security vulnerabilities
- Use requirements-lock.txt instead of requirements.txt for reproducibility
- Check both production and dev dependencies
This ensures:
- Security audit actually runs and fails on vulnerabilities
- Locked dependencies are used for consistent results
- No silent failures masking security issues
- Generate requirements-lock.txt and requirements-dev-lock.txt via pip-compile
- CI uses locked files for reproducible installs
- Add web unit tests to CI (npm run test:unit)
- Add dependency-audit job using pip-audit
- Add Makefile with lock/lock-dev targets for regeneration
ik