Add tested agent workflow and security checks

[esnoko]

DevTrack currently has no automated merge checks or backend tests. This adds a repeatable agent workflow with offline behavior tests, production frontend builds, dependency audits, and redacted secret scanning on pull requests.

Changes:

• Add AGENTS.md, development workflow documentation, and a PR validation template.
• Cover scoring, cache expiry/concurrency, GitHub pagination/failures, and HTTP contracts with 13 Node tests.
• Make the Express app importable for tests while preserving direct server startup.
• Add read-only CI with pinned Actions and weekly Dependabot updates.
• Patch vulnerable dependencies, including a patched qs 6.x override for Express.

Validation:

• npm run check: 13 tests passed; production frontend build passed.
• All three npm audits: zero vulnerabilities.
• Gitleaks: no leaks in 124 commits or the current project snapshot.
• Workflow/Dependabot YAML parsed; git diff --check passed.

Review notes:

• The frontend still reports its existing bundle-size warning.
• Solo-maintainer policy requires a PR and owner review before merging, with zero mandatory third-party approvals. Required CI checks are temporarily suspended during the account billing lock.
• Hosting configuration is unchanged. Review and merge manually after CI passes.

Repository setup:

• master requires a PR and resolved conversations, including for administrators. Zero external approvals are required for the solo owner. The three required CI status checks have been temporarily removed with owner approval while the account billing lock prevents execution. Restore them once Actions works again.
• Secret scanning and push protection were already enabled. Dependabot vulnerability alerts and security fix PRs are now enabled.

Hosted CI status:
GitHub did not start any CI jobs because it reports that the account is locked due to a billing issue. Local validation passed, but hosted CI remains unverified. The owner approved temporarily removing the required-check merge gate so this PR can be manually reviewed and merged. The test and security workflows remain in the PR.
Run: https://github.com/esnoko/DevTrack/actions/runs/38399939073

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
dev-track	Ready	Preview	Oct 13, 2026 1:00pm UTC