chore(16-02): seed audit allowlist (esbuild GHSA waiver) + outdated pin reasons

- audit-allowlist.json: GHSA-gv7w-rqvm-qjhr waiver (esbuild dev transitive via drizzle-kit/vitest/vite; not in production runtime)
- outdated-pins.json: intentional pin reasons for eslint, @eslint/js, zod, @types/node

scripts/audit-allowlist.json

@@ -0,0 +1,7 @@
+{
+  "GHSA-gv7w-rqvm-qjhr": {
+    "reason": "esbuild integrity-check advisory; transitive dev-only via drizzle-kit/vitest/vite; not in the production runtime — esbuild never runs in the shipped image; patched in esbuild >=0.28.1, will resolve when drizzle-kit bumps the transitive pin",
+    "reviewer": "luc",
+    "expires": "2026-09-01"
+  }
+}

scripts/outdated-pins.json

@@ -0,0 +1,6 @@
+{
+  "eslint": "ESLint 10 breaks eslint-plugin-react@7.37.5 (jsx-eslint#3977). Unpin when plugin releases ESLint 10 support.",
+  "@eslint/js": "Pinned with eslint — same constraint.",
+  "zod": "zod v4 has breaking API changes. Pin at 3.x until migration is planned.",
+  "@types/node": "Pinned to Node 22 LTS types to match runtime; Node 25 is not LTS."
+}