feat(quality): add security and accessibility gates

[ericyangpan]

What changed

• upgrade Next.js, OpenNext Cloudflare, next-intl, React, Vitest, Wrangler, AJV, and vulnerable transitive dependencies
• add a required high/critical dependency audit job and document the dependency security policy
• add Axe-powered browser checks for search, language selection, model comparison, and mobile navigation
• fix accessible names, ARIA relationships, contrast, and decorative content exposed by those checks
• keep Playwright readiness stable with locale negotiation and Next.js development caching

Why

The dependency tree contained 42 npm advisories, including critical and high severity issues, while interactive UI regressions were only covered by functional browser tests. The project needed automated gates for both risks.

Impact

The official npm audit now reports zero vulnerabilities. CI will block future high or critical advisories, and the browser suite will block serious or critical accessibility regressions in the covered journeys.

Validation

• npm run security:audit (0 vulnerabilities)
• npm run check
• npm run test:ci (35 passed, 4 skipped)
• CI=1 npm run test:e2e:ci (7 passed)
• npm run data-health:check
• npm run changelog:check -- --base=origin/main
• generated output consistency check
• npm run build (Next.js and OpenNext Cloudflare)

Stack

This draft PR is based on agent/e2e-changelog and should be reviewed after #145.

[github-actions]

Preview deployment

Status	URL
Ready	https://pr-146-aicodingstack.pr-preview.workers.dev

Commit: b79e37e
Updated: 2026-07-18T22:23:23.507Z

[github-actions]

Preview deployment cleaned up

The preview deployment for PR #146 has been removed.