feat: add eslint-plugin-security rules for static analysis

Adds 12 security-focused ESLint rules (unsafe-regex, eval, timing
attacks, child-process, bidi-characters, etc). One legitimate
non-literal RegExp in answers.ts suppressed with inline comment.
CI already runs pnpm lint + pnpm audit for SAST coverage.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

package.json

@@ -19,6 +19,7 @@
     "@typescript-eslint/parser": "^8.56.1",
     "concurrently": "^9.1.2",
     "eslint": "^10.0.3",
+    "eslint-plugin-security": "^4.0.0",
     "typescript": "^5.7.3",
     "vitest": "^3.1.1"
   }