Fix pip → python3 -m pip in ruff job; add pip-audit dep scan

- python3 -m pip works in the act runner where bare 'pip' isn't in PATH
- Added python-audit job: pip-audit checks matrixbot/requirements.txt
  against the OSV database for known CVEs on every push/PR

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitea/workflows/lint.yml

@@ -38,10 +38,22 @@ jobs:
       - uses: actions/checkout@v3
 
       - name: Install ruff
-        run: pip install ruff
+        run: python3 -m pip install ruff
 
       - name: Check syntax errors
-        run: ruff check matrixbot/ --select E9,F63,F7,F82 --output-format=github
+        run: python3 -m ruff check matrixbot/ --select E9,F63,F7,F82 --output-format=github
 
       - name: Run full lint
-        run: ruff check matrixbot/ --output-format=github
+        run: python3 -m ruff check matrixbot/ --output-format=github
+
+  python-audit:
+    name: Python deps (pip-audit)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Install pip-audit
+        run: python3 -m pip install pip-audit
+
+      - name: Audit matrixbot dependencies
+        run: python3 -m pip_audit -r matrixbot/requirements.txt