feat: add eslint-plugin-security rules for static analysis

Adds 12 security-focused ESLint rules (unsafe-regex, eval, timing
attacks, child-process, bidi-characters, etc). One legitimate
non-literal RegExp in answers.ts suppressed with inline comment.
CI already runs pnpm lint + pnpm audit for SAST coverage.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/src/engine/answers.ts

@@ -155,6 +155,7 @@ export function checkAnswer(response: string | null, acceptedAnswers: string[]):
     if (accNum !== null) {
       const numStr = String(accNum)
       // Only match if the number appears as a whole token, not as a substring of a larger number
+      // eslint-disable-next-line security/detect-non-literal-regexp -- numStr is a parsed number, escaped
       const numRegex = new RegExp(`(?<![\\d])${numStr.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?![\\d])`)
       if (numRegex.test(normResponse)) return 1.0
       // Check number words in response