Fix picomatch audit vulnerability and complete security hardening verification

Override picomatch to 4.0.4 to resolve high-severity ReDoS (GHSA-c2c7-rcm5-vvqj),
verify all security hardening tasks (gitleaks, pnpm audit, Docker non-root,
Caddy headers, scanner blocking), sync specs, and archive the change.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

package.json

@@ -22,6 +22,11 @@
     "dev:services": "docker compose -f docker-compose.dev.yml up -d",
     "dev:full": "./scripts/dev.sh"
   },
+  "pnpm": {
+    "overrides": {
+      "picomatch@>=4.0.0 <4.0.4": "4.0.4"
+    }
+  },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
     "@playwright/test": "^1.58.2",