feat: add eslint-plugin-security rules for static analysis

Adds 12 security-focused ESLint rules (unsafe-regex, eval, timing
attacks, child-process, bidi-characters, etc). One legitimate
non-literal RegExp in answers.ts suppressed with inline comment.
CI already runs pnpm lint + pnpm audit for SAST coverage.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

eslint.config.js

@@ -1,5 +1,6 @@
 import tseslint from '@typescript-eslint/eslint-plugin'
 import tsparser from '@typescript-eslint/parser'
+import security from 'eslint-plugin-security'
 
 export default [
   {
@@ -15,10 +16,24 @@ export default [
     },
     plugins: {
       '@typescript-eslint': tseslint,
+      security: security,
     },
     rules: {
       '@typescript-eslint/no-floating-promises': 'error',
       'no-console': ['warn', { allow: ['warn', 'error'] }],
+      // Security rules (from eslint-plugin-security)
+      'security/detect-buffer-noassert': 'warn',
+      'security/detect-child-process': 'warn',
+      'security/detect-eval-with-expression': 'error',
+      'security/detect-new-buffer': 'warn',
+      'security/detect-non-literal-regexp': 'warn',
+      'security/detect-non-literal-require': 'warn',
+      'security/detect-possible-timing-attacks': 'warn',
+      'security/detect-pseudoRandomBytes': 'warn',
+      'security/detect-unsafe-regex': 'error',
+      'security/detect-bidi-characters': 'error',
+      // detect-object-injection has too many false positives — skip
+      // detect-non-literal-fs-filename too noisy for server code — skip
     },
   },
   // Frontend game engine: fire-and-forget async (audio, animations) is intentional