fix(deps): patch socket.io-parser advisory; add local CI preflight gate

Security Audit failed on a newly-published advisory, GHSA-2m8v-j782-fhvr
(socket.io-parser "Zero-attachment Memory Exhaustion", high). It affected both
projects transitively via socket.io / socket.io-client. Patched to 4.2.7 in both
lockfiles; no direct dependency versions changed.

Also adds the gate that should have caught the previous two CI failures before
they reached GitHub:

- scripts/ci-preflight.sh runs every gate from .github/workflows/ci.yml
  (frontend and backend lint/type-check/build, plus both prod-dependency audits
  with the same audit-ci flags and allowlist) and additionally the backend Jest
  suite, which CI does not currently run. It runs all gates rather than failing
  fast, so one invocation surfaces every problem. ~35s.
- scripts/claude-push-gate.sh wires that into a Claude Code PreToolUse hook so a
  `git push` is refused while any gate fails, with the failure detail returned
  inline. Non-push commands and --dry-run pass straight through.

Verified: with the fix reverted, the gate correctly denied the push and reported
"backend: lint FAIL"; with it restored, all 9 gates pass and both audit-ci
invocations exit 0.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/claude-push-gate.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+# Claude Code PreToolUse(Bash) hook: refuse `git push` until the local CI gates pass.
+#
+# Reads the hook payload on stdin. Non-push commands exit immediately, so the
+# overhead on ordinary Bash calls is one short script invocation.
+#
+# On failure it emits a PreToolUse deny decision, which blocks the push and hands
+# the reason back to the model so it can fix the problem instead of retrying.
+
+set -uo pipefail
+
+PAYLOAD="$(cat)"
+CMD="$(printf '%s' "$PAYLOAD" | jq -r '.tool_input.command // ""' 2>/dev/null)"
+
+# Only gate actual pushes (covers `git push`, `git -C <dir> push`, flags, etc.).
+# Deliberately ignores --dry-run.
+if ! printf '%s' "$CMD" | grep -Eq '(^|[;&|]|\s)git(\s+-[^;&|]*)?\s+push(\s|$)'; then
+  exit 0
+fi
+if printf '%s' "$CMD" | grep -q -- '--dry-run'; then
+  exit 0
+fi
+
+REPO="/Users/rteslow/mikrotik-manager"
+[[ -x "$REPO/scripts/ci-preflight.sh" ]] || exit 0   # nothing to enforce
+
+if OUTPUT="$("$REPO/scripts/ci-preflight.sh" 2>&1)"; then
+  exit 0
+fi
+
+DETAIL="$(tail -60 /tmp/ci-preflight-failures 2>/dev/null)"
+python3 - "$OUTPUT" "$DETAIL" <<'PY'
+import json, sys
+summary, detail = sys.argv[1], sys.argv[2]
+reason = (
+    "Push blocked: the local CI gates failed, so this would fail on GitHub too.\n\n"
+    f"{summary.strip()}\n\n{detail.strip()}\n\n"
+    "Fix these, re-run scripts/ci-preflight.sh until it passes, then push."
+)
+print(json.dumps({
+    "hookSpecificOutput": {
+        "hookEventName": "PreToolUse",
+        "permissionDecision": "deny",
+        "permissionDecisionReason": reason,
+    }
+}))
+PY
+exit 0