Add Python 3.13 to CI matrix and pip-audit security job

[Larslllllll]

Summary

• Add Python 3.13 to the test matrix
• Add pip-audit job for dependency vulnerability scanning in CI

Acceptance Criteria

Python 3.13 (#114)

• 3.13 matrix entry
• Green suite (will be verified by CI run)

Dependency vulnerability audit (#115)

• CI job running pip-audit
• Triage/allowlist doc (optional - can be addressed separately)

Closes #114
Closes #115

[codeforstartups]

Thanks @Larslllllll! Adding Python 3.13 to the matrix is great. Two blockers:

1. pip-audit step is misconfigured (same as in #117): gh-action-pip-audit takes inputs:, not requirements:, and pyproject.toml is not a requirements file — this job would fail. Use:

       - name: Run pip-audit
         uses: pypa/gh-action-pip-audit@v1.1.0
         with:
           inputs: .

2. Duplicate of #117's ci.yml change. To avoid conflicts, let's keep the ci.yml change in one PR only. I'm inclined to land it via #117 (which also adds pre-commit + CONTRIBUTING). Could you either close this in favor of #117, or rebase this to only the 3.13 matrix bump if you'd prefer it separate? Happy either way.

[codeforstartups]

👋 Still blocked on one line. The pip-audit step uses an input that doesn't exist and a file it can't read:

      - name: Run pip-audit
        uses: pypa/gh-action-pip-audit@v1.1.0
        with:
          inputs: .        # not: requirements: pyproject.toml

Also this duplicates #117's ci.yml change — let's land the ci.yml bump in one PR (I'd suggest #117, which also adds pre-commit + CONTRIBUTING) and close/trim this to just the 3.13 matrix if you still want it separate.

[codeforstartups]

The 3.13 matrix bump is now handled by #158 (clean, approved). This PR's pip-audit step is still misconfigured (requirements: pyproject.toml → should be inputs: .), so I'd suggest closing this in favor of #158, and opening a separate PR for pip-audit later if you'd like. Thanks @Larslllllll!