feat: add native coverage, audit, duplication, and SAST gates

[SynthLuvr]

Summary

Adds the four quality gaps — coverage, SCA (dependency audit), SAST, and code duplication — natively, using the existing pnpm + vitest + oxlint stack. No new quality-tool binary, no second config system.

This came out of evaluating LucidShark: every capability it adds is achievable with tools this template already uses, so this keeps the stack lean.

Changes

• vitest.config.ts — v8 coverage with an 80% threshold (statements/branches/functions/lines). Gated via test (vitest run --coverage); test:watch stays clean.
• package.json
  • test → vitest run --coverage (coverage gate)
  • lint:audit → pnpm audit --prod (production dependency vulnerability scan)
  • lint:duplicates → jscpd (duplication gate, 5% threshold)
  • both wired into the lint aggregate
  • new devDeps: @vitest/coverage-v8, jscpd
• .oxlintrc.json — enable 6 security-oriented rules (verified passing on current code): no-eval, no-implied-eval, no-new-func, no-unsafe-finally, no-unsafe-negation, no-unsafe-optional-chaining
• .gitignore — ignore generated coverage/ and report/ so biome check . stays green after a local test run (biome uses vcs.useIgnoreFile)

Why these thresholds

• Coverage 80% — current code is at 100%; 80% is a conventional floor.
• Duplication 5% — current code is 0%; flags meaningful copy-paste without noise.
• pnpm audit --prod — gates shipped (production) vulnerabilities; avoids breaking CI on dev-only transitive advisories.

Verification

• pnpm build, pnpm lint, pnpm test all pass (true exit codes).
• Gate is idempotent: pnpm lint stays green even when coverage/ exists (i.e. after running test then lint locally).
• pnpm install --frozen-lockfile succeeds (CI parity).

Gap → native solution

Gap	Native solution	Where
Coverage	vitest v8 + 80% threshold	pnpm test
SCA (dep vulns)	pnpm audit --prod	pnpm lint
SAST	oxlint security rules	pnpm lint
Duplication	jscpd 5%	pnpm lint