[Infra] Supply-chain hardening (cargo audit / cargo deny + Dependabot)

[Gbangbolaoluwagbemiga]

Problem

There is no automated scanning for known-vulnerable dependencies in either the cargo or npm trees,
and no automated dependency updates.

What needs to be done

• Add cargo audit (RustSec advisory DB) as a CI step; fail on vulnerabilities
• Add cargo deny with a deny.toml covering advisories, licenses, and duplicate/banned crates
• Add .github/dependabot.yml for cargo, npm (root + backend/), and github-actions
• Triage and resolve the first batch of findings

Acceptance criteria

• CI fails on a known-vulnerable dependency
• deny.toml committed and passing
• Dependabot opens update PRs

Relevant files

.github/workflows/node.yml, new deny.toml, new .github/dependabot.yml, Cargo.lock, package-lock.json, backend/package-lock.json

References

• https://github.com/rustsec/rustsec · https://embarkstudios.github.io/cargo-deny/