Resolve repository security findings

[jongan69]

Resolve the active CodeQL findings, migrate Node tooling to Bun, pin and minimize workflow permissions, and document any time-limited dependency exception. Acceptance: frozen install, quality checks, Android export, and hosted security checks pass.

[jongan69]

Resolved by #10. The repository now passes Bun frozen install, Expo validation, typechecks, tests, Android export, and hosted security checks; retained exceptions remain tracked separately.