ci: improve reproducibility and add dependency audit gate

Use lockfile-driven installs in Docker paths and add high-severity npm audit checks in CI while documenting local CORS policy for compose-based development.

Made-with: Cursor

solver-api/Dockerfile

@@ -5,7 +5,7 @@ WORKDIR /app
 RUN apk add --no-cache build-base
 
 COPY package.json package-lock.json* ./
-RUN npm install
+RUN npm ci
 
 COPY src ./src