fix: clear dependency security advisories

hub/deploy/README.md

@@ -21,6 +21,11 @@ run the same command again. No systemd unit is installed until configuration,
 paths, Node, bubblewrap, `socat`, `cph --version`, PostgreSQL connectivity and directory
 ownership all pass preflight.
 
+The deployment path also runs `npm run audit:production` from the locked clean
+install before building or restarting the service. A current high or critical
+production advisory therefore blocks deployment instead of becoming a warning
+buried in CI output.
+
 An existing service account is accepted only when its primary group, home and
 non-login shell match the requested configuration and it has no supplementary
 groups. After provisioning, the installer executes path-access, built Hub,

hub/deploy/deploy_platform.sh

@@ -36,8 +36,8 @@ rsync -az --delete \
   -e "ssh ${SSH_OPTS[*]}" \
   "$REPO_ROOT/hub/" "$DEPLOY_USER@$HOST:$HUB_DIR/"
 
-# 2. Install deps + build on the host.
-ssh "${SSH_OPTS[@]}" "$DEPLOY_USER@$HOST" "cd '$HUB_DIR' && npm ci && npm run build"
+# 2. Install deps, prove the production dependency tree, then build on the host.
+ssh "${SSH_OPTS[@]}" "$DEPLOY_USER@$HOST" "cd '$HUB_DIR' && npm ci && npm run audit:production && npm run build"
 
 # 3. Ensure the service is installed (idempotent), then restart.
 ssh "${SSH_OPTS[@]}" "$DEPLOY_USER@$HOST" "