Add bandit for Python security linting

- Add bandit as dev dependency
- Configure in pyproject.toml (exclude venv/tests)
- Skip B101 (assert) and B311 (random for non-crypto)
- Add Makefile target: security-backend

backend/pyproject.toml

@@ -22,6 +22,7 @@ dev = [
     "mypy>=1.13.0",
     "ruff>=0.14.10",
     "pytest-cov>=7.0.0",
+    "bandit>=1.9.2",
 ]
 
 [tool.mypy]
@@ -68,3 +69,10 @@ exclude_lines = [
 ]
 show_missing = true
 
+[tool.bandit]
+exclude_dirs = ["tests", ".venv"]
+skips = [
+    "B101",  # assert warnings (used in tests)
+    "B311",  # random for non-security purposes (invite codes)
+]
+