Initial Coworker app scaffold

.gitea/workflows/security-scan.yml

@@ -0,0 +1,30 @@
+name: Scheduled Security Scan
+
+on:
+  schedule:
+    - cron: "17 3 * * 1"
+  workflow_dispatch:
+
+jobs:
+  security-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Scan suspicious patterns
+        run: |
+          rg -n "eval\\(|new Function|innerHTML\\s*=|shell:\\s*true|LOCALHOST_BYPASS|coworker_token" apps packages docs || true
+
+      - name: Scan secret-prone files
+        run: |
+          if find . -type f \( -name ".env" -o -name "*.pem" -o -name "*.pfx" -o -name "*.p12" -o -name "*.key" \) | rg .; then
+            echo "Secret-prone file is tracked or present in workspace"
+            exit 1
+          fi
+
+      - name: Install dependencies
+        run: npm install
+
+      - name: Audit
+        run: npm run audit