fix(ci): pre-commit hooks + pip-audit (security scanner)

sprint25 (suite): tracker les partials web/templates/*.html

sprint25: refactor web frontend en Jinja2 + JS externe (miroir Sprint 17)