feat(infra+processing): distributed event-filter store, dependabot, security scan

[Eleora57]

Closes #351, Closes #368, Closes #372.

Summary

This PR resolves all three issues assigned to @Eleora57 in one batch:

• processing: EventFilter configs are worker-local — filter changes don't propagate in multi-worker deployments #351 — EventFilter configs are now distributed across worker pods via a pluggable FilterConfigStore (memory default, Redis-backed for clusters). Each setConfig/clearConfig call fans out to peer workers in real time through a Redis hash + pub/sub channel, with a periodic reconcile loop for missed messages.
• infra: No Dependabot or Renovate configuration for automated dependency updates #368 — adds .github/dependabot.yml automating weekly dependency updates for the root workspace, every package (app, api, xstreamroll-sdk, xstreamroll-processing), and GitHub Actions. Per-workspace PR caps of 3-5 keep the queue manageable.
• infra: Docker images not scanned for vulnerabilities in CI #372 — adds .github/workflows/security-scan.yml running Trivy against the filesystem and each of the three production Docker images (api, app, xstreamroll-processing). SARIF results land in the GitHub Security tab; a PR-comment summarises critical/high counts. The job listens on pull_request_target so fork PRs (where the standard event strips write permissions) still receive the summary.

Changes

Issue #351 (processing/event-filter)

File	Change
xstreamroll-processing/src/pipeline/event-filter-store.ts	New file. Abstract FilterConfigStore + MemoryFilterConfigStore + RedisFilterConfigStore + createFilterConfigStore factory. Defensive copies on every read/write; reconcile interval as the safety net for missed pub/sub messages.
xstreamroll-processing/src/pipeline/event-filter.ts	EventFilter now delegates to an injected store. setConfig/clearConfig update the in-memory map synchronously so the hot-path allow(event) call never awaits the store; transient Redis outages cannot stall the polling loop. The cached startPromise is cleared on install failure so subsequent calls retry instead of bricking the filter.
xstreamroll-processing/src/pipeline/index.ts	Re-exports the new types alongside the existing class.
xstreamroll-processing/src/config.ts	New env vars: EVENT_FILTER_BACKEND (memory/redis, default memory) and EVENT_FILTER_REDIS_URL (optional, falls back to REDIS_URL).
xstreamroll-processing/.env.example	Documents the new vars and the cluster semantics.
xstreamroll-processing/src/worker.ts	New initFilterStore() pick the backend, swap it into the default filter via setStore(), call await filter.start() before spinning the registry, and register a graceful-shutdown hook that closes the store.
xstreamroll-processing/package.json	Adds ioredis@^5.4.1 runtime dependency.
xstreamroll-processing/__tests__/event-filter-store.test.ts	New. Memory store tests + factory tests + regression for the startPromise-stuck-on-failure bug.
xstreamroll-processing/__tests__/event-filter-store-redis.test.ts	New. Cross-instance pub/sub + initial-snapshot replay + malformed-payload hardening via a faked ioredis.
xstreamroll-processing/__tests__/integration/pipeline.integration.test.ts	Mocks EventFilter extended with no-op start/close/setStore/setConfig/clearConfig so the worker startup sequence is exercised end-to-end.

Issue #368 (dependabot)

File	Change
.github/dependabot.yml	New file. Watches the root, every workspace package, and GitHub Actions on a weekly Monday schedule. PRs labelled dependencies/automated. Commits prefixed chore(deps*) per workspace.

Issue #372 (security scan)

File	Change
.github/workflows/security-scan.yml	New file. Trivy filesystem scan + matrix-built image scan (api/app/processing). SARIF uploads land in the GitHub Security tab. Worker-level concurrency cancellation per github.ref. Schedules weekly Monday 06:15 UTC.

Verification

• npx tsc --noEmit is clean.
• npx jest --runInBand is green: 110 tests pass across 13 suites, including the existing event-filter.test.ts (unchanged, still uses the synchronous f.setConfig(...) pattern), the new event-filter-store.test.ts, and the new event-filter-store-redis.test.ts that exercises cross-instance pub/sub through a faked ioredis client.
• The existing worker.test.ts and pipeline.integration.test.ts continue to pass without modification beyond the mock extension described above.

Backwards compatibility

• EVENT_FILTER_BACKEND defaults to memory, so existing single-worker deployments see no behaviour change.
• EVENT_FILTER_REDIS_URL is optional and falls back to REDIS_URL so workers sharing the API's Redis need no extra config.
• If a Redis-backed install fails at startup, the worker logs loudly and falls back to in-process state with the continue-with-empty-filter safety net; polling never stalls.

Suggested followups (out of scope, future PRs)

• SHA-pin aquasecurity/trivy-action, docker/build-push-action, docker/setup-buildx-action, github/codeql-action so a tag repoint cannot silently change behaviour. Tracked as a one-line follow-up per action.
• Add POST /admin/filters/:streamId to the worker's existing metrics HTTP server so operators can push filter changes without booting a Redis-cli session. (The plumbing is in place — only the HTTP handler and an auth check are missing.)
• Verify OpenTelemetry instrumentation on the new ioredis client doesn't double-instrument the API's cache-manager-redis-store instance under the same Redis.

[Xhristin3]

@Eleora57 resolve conflicts