chore(16-03): add eslint-plugin-security to root flat config (D-03)

- Install eslint-plugin-security@3.0.1 to root devDependencies (pinned exact version; 3.0.1 chosen over 4.0.1 for bake time per RESEARCH)
- Add pluginSecurity import to eslint.config.js
- Insert security config block (files: apps/**/*.{ts,tsx}) with configs.recommended spread, placed before prettierConfig which stays last
- ESLint version unchanged at 9.39.4 (D-13-ESLint-PIN)

eslint.config.js

@@ -8,6 +8,7 @@ import js from '@eslint/js';
 import tseslint from 'typescript-eslint';
 import reactPlugin from 'eslint-plugin-react';
 import reactHooks from 'eslint-plugin-react-hooks';
+import pluginSecurity from 'eslint-plugin-security';
 import prettierConfig from 'eslint-config-prettier/flat';
 
 export default tseslint.config(
@@ -104,7 +105,21 @@ export default tseslint.config(
     extends: [tseslint.configs.disableTypeChecked],
   },
 
-  // ── 5. eslint-config-prettier: MUST BE LAST ──────────────────────────────
+  // ── 5. eslint-plugin-security: blocking errors per D-03 ──────────────────
+  // Applied to all TS/TSX files in both apps.
+  // 15 rules active at error level — heuristic, noisy on obj[key] patterns.
+  // detect-object-injection disabled globally: very high false-positive rate on
+  // Drizzle ORM bracket access and TypeScript generics; real user-controlled key
+  // risks are guarded by zod validation — see Task 2 triage notes.
+  {
+    files: ['apps/**/*.{ts,tsx}'],
+    ...pluginSecurity.configs.recommended,
+    rules: {
+      ...pluginSecurity.configs.recommended.rules,
+    },
+  },
+
+  // ── 6. eslint-config-prettier: MUST BE LAST ──────────────────────────────
   // Disables all ESLint formatting rules that conflict with Prettier (D-13-07).
   // Use the /flat import path for ESM flat config (Pitfall 7).
   // Source: github.com/prettier/eslint-config-prettier