ci: improve reproducibility and add dependency audit gate

Use lockfile-driven installs in Docker paths and add high-severity npm audit checks in CI while documenting local CORS policy for compose-based development.

Made-with: Cursor

docker-compose.yml

@@ -7,6 +7,8 @@ services:
     working_dir: /app
     ports:
       - "4400:4400"
+    environment:
+      - CORS_ORIGINS=http://localhost:5173
     volumes:
       - ./solver-api/src:/app/src
       - ./data:/data