feat: add bootcamp security command for standalone security analysis

[Arthur742Ramos]

Summary

Adds bootcamp security <repo-url> — the third deterministic, LLM-free report command, completing the health / metrics / security trio.

bootcamp health and bootcamp metrics already expose their generation engines as standalone, scannable, CI-gateable commands. The SECURITY.md engine (analyzeSecurityPatterns) had no standalone equivalent — this closes that gap.

What it reports

Scans any repo (local path or remote URL) and reports the deterministic security analysis that powers SECURITY.md:

• Findings — title, severity (critical→info), file/line, and remediation, sorted most-severe-first
• Protection coverage — security headers (helmet), CORS, CSP, rate limiting, input validation, SQL-injection prevention, secret handling (gitignored, .env.example)
• Security-relevant dependencies
• 0–100 score + A–F grade

$ bootcamp security ./my-repo
🔒 Security Analysis
Repository: local/my-repo
Scanned 224 files

🟢 100/100 (Grade: A)
Findings: ⚪ 6 info

Protections
  ✓ security headers (helmet)   · CORS   ✓ CSP
  ✓ rate limiting   ✓ input validation   · SQL-injection prevention
  ...

Flags

Mirror health/metrics: --json, --check / --min-score (CI gate), --branch, --max-files (routed past root-command flag collisions), --keep-temp, --verbose.

Implementation

Mirrors health-command.ts / metrics-command.ts in structure and reuses analyzeSecurityPatterns verbatim (reading package.json the same way the generation pipeline does), so the output can never drift from SECURITY.md.

Testing

• 9 unit tests (DI-mocked resolve/scan/analyze): report, --json, --check both directions, custom --max-files, local path, --keep-temp, scan-failure cleanup, resolve-failure.
• 3 E2E tests spawning the real CLI against a fixture with detectable patterns (helmet + rate-limit deps, .env gitignored): human report, JSON shape, and the --check gate in both directions.
• Full suite green: npm test → 1124 passing; typecheck + lint + build clean.

🤖 Generated with Claude Code