chore(16-03): triage eslint-plugin-security findings to green

- Disable detect-object-injection globally in eslint.config.js: all hits were
  numeric loop array indices (ranks[i]) — not user-controlled keys; zod guards
  real API input boundaries; justification comment added (T-16-09)
- Add inline eslint-disable for detect-non-literal-fs-filename at 2 sites:
  - apps/api/src/index.ts: realpathSync(process.argv[1]) — runtime entry path, not user input
  - apps/api/tests/broker/expand.test.ts: readFileSync of test fixture path — test-controlled
- pnpm lint exits 0 across both apps with --max-warnings 0
- 14 of 15 security rules remain active at error; no blanket file disables

apps/api/src/index.ts

@@ -101,6 +101,7 @@ app.get('*', serveStatic({ path: './public/index.html' }));
 function isMainModule(): boolean {
   if (!process.argv[1]) return false;
   try {
+    // eslint-disable-next-line security/detect-non-literal-fs-filename -- process.argv[1] is the Node runtime entry path, not user input
     return fileURLToPath(import.meta.url) === realpathSync(process.argv[1]);
   } catch {
     return false;