[vitormattos]

Purpose

Adopt the reviewed npm-audit workflow from LibreCodeCoop/.github PR #104, using its pinned Nextcloud source and security patch.

Changes

• Align npm-audit-fix.yml with the central catalog and a local patch preserving the existing Sunday schedule and review labels.
• Limit the audit matrix to the default branch, which targets Nextcloud 33. Nextcloud 31 reached EOL in February 2026 and Nextcloud 32 reached EOL in September 2026; both must no longer receive automated support. See https://github.com/nextcloud/server/wiki/Maintenance-and-Release-Schedule .
• Replace COMMAND_BOT_PAT with the short-lived, repository-scoped GitHub App token. Use conventional fix(deps) PR titles and DCO. No automatic approval or merge.
• Align sync-workflow-templates.yml with the LibreCode implementation and an opt-in consumer patch including only npm-audit-fix.yml. Other divergent workflows remain untouched pending separate review.

Validation

• Organization GitHub App is installed and organization-level client ID/private-key settings are configured.
• On an isolated checkout of the current PR HEAD, both workflows match the catalog plus their consumer patches byte-for-byte.
• First sync adopted the npm audit workflow; second sync produced no changes. No divergent workflows were overwritten.
• Original CI passed; a new CI run after EOL branch removal must pass before merge. Signed/DCO commits preserved.

Dependency and review

Merge catalog PR #104 first. Requires independent maintainer review. Related EOL backport PRs #166 and #167 were closed without merge when their unsupported versions were verified. No releases were made.