build(deps): pin a reproducible lock + pip-audit; bump node 20->22 (E1 S4, SEC-5/DX-3)

requirements.txt stays the source (floor ranges); requirements.lock pins the
exact resolved versions (generated in the python:3.12-slim prod base, extras like
psycopg-binary/uvloop included). The prod Dockerfile, Dockerfile.test and CI now
install the lock, so the image is reproducible and the versions are the ones
pip-audit scans. CI gains a non-blocking pip-audit step over the lock. The
frontend build + CI move from the EOL node 20 to node 22.

.gitea/workflows/check.yml

@@ -3,12 +3,12 @@
 #   frontend — tsc (3 projects) + eslint + prettier --check + knip + vitest
 #   backend  — ruff + the full pytest suite (pure-logic + the DB-backed lane) against a real Postgres
 #
-# Runner: the lab act_runner (LXC 115) maps `ubuntu-latest` -> node:20-bookworm and mounts the Docker
-# socket, so service containers work. The backend runs pytest NATIVELY against a `postgres` service
-# (not the local docker-compose.test.yml, whose bind-mount is unreliable under a mounted-socket runner);
-# fidelity is kept by installing the SAME pinned requirements, Postgres 16, and ffmpeg, and by setting
-# SIFTLODE_TEST_REQUIRE_DB=1 so a DB/ffmpeg that failed to come up is a hard error, never a silent skip.
-# node 20 matches the prod build image (Dockerfile `node:20-alpine`); S4's node-22 bump moves both.
+# Runner: the lab act_runner (LXC 115) mounts the Docker socket, so service containers work. The backend
+# runs pytest NATIVELY against a `postgres` service (not the local docker-compose.test.yml, whose
+# bind-mount is unreliable under a mounted-socket runner); fidelity is kept by installing the SAME pinned
+# requirements, Postgres 16, and ffmpeg, and by setting SIFTLODE_TEST_REQUIRE_DB=1 so a DB/ffmpeg that
+# failed to come up is a hard error, never a silent skip. node 22 matches the prod build image
+# (Dockerfile `node:22-alpine`).
 name: gate
 
 on: [push, pull_request]
@@ -16,7 +16,7 @@ on: [push, pull_request]
 jobs:
   frontend:
     runs-on: ubuntu-latest
-    container: node:20-bookworm
+    container: node:22-bookworm
     defaults:
       run:
         working-directory: frontend
@@ -56,9 +56,14 @@ jobs:
       - run: apt-get update && apt-get install -y --no-install-recommends ffmpeg postgresql-client
       - name: Wait for Postgres
         run: until pg_isready -h postgres -U siftlode -d siftlode_test; do sleep 1; done
-      - run: pip install --no-cache-dir -r backend/requirements.txt -r backend/requirements-dev.txt
+      - run: pip install --no-cache-dir -r backend/requirements.lock -r backend/requirements-dev.txt
       - name: ruff
         run: python -m ruff check --config backend/ruff.toml backend scripts
       - name: pytest
         run: python -m pytest
         working-directory: backend
+      # Dependency CVE audit over the pinned lock. Non-blocking for now (informational) — a real CVE
+      # shows up in the run without failing the gate; tighten to a hard fail once the noise is known.
+      - name: pip-audit (advisory)
+        run: pip install --no-cache-dir pip-audit && pip-audit -r backend/requirements.lock
+        continue-on-error: true