chore: track audit prompt, ignore generated audit report

[andregoepel]

What

• Add .gitignore rules so the local security-audit report stays untracked, while the prompt is version-controlled:

  /audit/*
  !/audit/audit-prompt.md
  

• Commit audit/audit-prompt.md (the reusable audit instructions).

Why

The audit/ folder holds a generated security review of this repository, including detailed exploit scenarios and attack chains. On a public repo those artifacts should not be committed — that would publish an exploit guide for as-yet-unfixed findings. The prompt that produces the report, however, is safe and useful to keep in the repo so the audit can be re-run.

Reviewer notes

• Only two files change: .gitignore (+4 lines) and the new audit/audit-prompt.md.
• Verified with git check-ignore: the generated report files (e.g. audit/scorecard.md, audit/executive-summary.md) are ignored; audit/audit-prompt.md is not.
• The audit findings themselves are tracked separately as issues [Security] Admin credentials placed in login handoff URL query string (F1) #50–[Security] MailMessage handler has no origin/authorization guard (F8) #57 (label security), sanitized to omit exploit walkthroughs.
• No source/application code is touched.