- Generate requirements-lock.txt and requirements-dev-lock.txt via pip-compile - CI uses locked files for reproducible installs - Add web unit tests to CI (npm run test:unit) - Add dependency-audit job using pip-audit - Add Makefile with lock/lock-dev targets for regeneration