Align repo config with global development standards

- Add missing tsconfig strictness flags (noUncheckedIndexedAccess,
  exactOptionalPropertyTypes, noImplicitOverride,
  noPropertyAccessFromIndexSignature) and fix all resulting type errors
- Replace ESLint/Prettier with oxlint 1.48.0 and oxfmt 0.33.0
- Pin all frontend and backend dependencies to exact versions
- Pin GitHub Actions to SHA hashes with persist-credentials: false
- Fix CI Python version mismatch (3.12 -> 3.14) and ruff target-version
- Add vitest 4.0.18 with jsdom environment for frontend testing
- Add ty 0.0.17 for Python type checking (non-blocking in CI)
- Add actionlint and zizmor CI job for workflow linting and security audit
- Add Dependabot config for npm, pip, and github-actions
- Update CLAUDE.md and pre-commit hooks to reflect new tooling
- Ignore Claude Code sandbox artifacts in gitignore

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend/pyproject.toml

@@ -3,25 +3,26 @@ name = "nuzlocke-tracker-api"
 version = "0.1.0"
 description = "Backend API for Nuzlocke Tracker"
 readme = "README.md"
-requires-python = ">=3.12"
+requires-python = ">=3.14"
 dependencies = [
-    "fastapi>=0.115.0",
-    "uvicorn[standard]>=0.34.0",
-    "pydantic>=2.10.0",
-    "pydantic-settings>=2.7.0",
-    "python-dotenv>=1.0.0",
-    "sqlalchemy[asyncio]>=2.0.0",
-    "asyncpg>=0.30.0",
-    "alembic>=1.14.0",
+    "fastapi==0.128.4",
+    "uvicorn[standard]==0.40.0",
+    "pydantic==2.12.5",
+    "pydantic-settings==2.12.0",
+    "python-dotenv==1.2.1",
+    "sqlalchemy[asyncio]==2.0.46",
+    "asyncpg==0.31.0",
+    "alembic==1.18.3",
 ]
 
 [project.optional-dependencies]
 dev = [
-    "ruff>=0.9.0",
-    "pre-commit>=4.0.0",
-    "pytest>=8.0.0",
-    "pytest-asyncio>=0.25.0",
-    "httpx>=0.28.0",
+    "ruff==0.15.0",
+    "ty==0.0.17",
+    "pre-commit==4.5.1",
+    "pytest==9.0.2",
+    "pytest-asyncio==1.3.0",
+    "httpx==0.28.1",
 ]
 
 [build-system]
@@ -32,7 +33,7 @@ build-backend = "hatchling.build"
 packages = ["src/app"]
 
 [tool.ruff]
-target-version = "py312"
+target-version = "py314"
 line-length = 88
 
 [tool.ruff.lint]
@@ -57,6 +58,12 @@ ignore = [
 [tool.ruff.lint.isort]
 known-first-party = ["app"]
 
+[tool.ty.environment]
+python-version = "3.14"
+
+[tool.ty.src]
+root = "src"
+
 [tool.pytest.ini_options]
 asyncio_mode = "auto"
 testpaths = ["tests"]