[Security] Security audit and vulnerability scanning

[OneByJorah]

Security Audit Checklist

• Add bandit for Python security linting
• Add safety/pip-audit for dependency vulnerability scanning
• Add trivy for Docker image scanning
• Implement secrets scanning (gitleaks, trufflehog)
• Add SAST scanning in CI
• Review and fix any hardcoded secrets
• Add security headers to HTTP responses
• Review HMAC implementation for timing attacks