Pin all dependencies with hashes and add a CVE audit

Only the direct dependencies were pinned. Werkzeug, Jinja2, MarkupSafe,
itsdangerous and the other transitive packages were resolved at build
time, so builds of the same commit could differ, and pip did not verify
the downloaded files. There was also no vulnerability scan.

- requirements.in / requirements-dev.in list the direct dependencies.
  requirements.txt / requirements-dev.txt are lockfiles generated by
  pip-compile with exact versions and hashes for every package. The dev
  lockfile is constrained by the production one.
- Makefile targets: lock-deps, update-deps, sync-deps and audit
  (pip-audit against requirements.txt).
- The locked production versions match the previously installed ones.
  The first audit found no known vulnerabilities.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -13,4 +13,14 @@ Start with `make run-dev`
 ## Configuration
 
 - `MAX_ORIGIN` (required in production): The public origin of MAX, e.g.
-  `https://max.finn.st`
+  `https://max.finn.st`
+
+## Dependencies
+
+Direct dependencies are listed in `requirements.in` (production) and
+`requirements-dev.in` (development tools). `requirements.txt` and
+`requirements-dev.txt` are lockfiles with exact versions and hashes
+
+- After changing a `.in` file: `make lock-deps` and `make sync-deps`
+- Update all dependencies: `make update-deps` and `make sync-deps`
+- Check for known vulnerabilities: `make audit` (before every release)