Add repository audit/upgrade plan, web UI hardening, file previews, and CI workflow

[canblmz1]

Motivation

• Provide automated repository quality/security auditing and an actionable upgrade plan exportable from the CLI.
• Harden the FastAPI web UI by validating inputs, enforcing analyze rate limits, and bounding preview sizes to reduce SSRF and memory-abuse risk.
• Improve developer experience by adding CI checks and developer tooling to catch lint/type/security issues early.

Description

• Add project_prompter.audit to run baseline repo audits and generate markdown upgrade plans, and wire it to a new --plan CLI flag and _run_plan handler in project_prompter.cli.
• Harden web API input handling and previews by introducing project_prompter.web_security (rate limiting and extra_ignore_dirs validation), project_prompter.web_services (bounded per-file and total preview generation), request model validation fields in project_prompter.web, and improved error handling for analysis tasks.
• Add small route helpers (project_prompter.web_routes) and include preview truncation metadata in scan results.
• Add CI workflow .github/workflows/ci.yml with a Python 3.10–3.12 matrix that installs dev deps and runs pytest, ruff, mypy (on core modules), bandit, and pip-audit (allowed to fail), and update pyproject.toml dev dependencies accordingly.
• Add unit tests for the audit functionality, CLI plan command, and web analyze rate limiting under tests/.

Testing

• Ran pytest which exercises tests/test_audit.py, tests/test_cli_plan.py, and tests/test_web_rate_limit.py, and the test suite completed successfully.
• Executed CI checks locally/defined in workflow: ruff linting, mypy on project_prompter/audit.py and project_prompter/web_security.py, and bandit security scan, all configured to run in the workflow.
• pip-audit is included in the CI but allowed to fail (|| true) to avoid breaking the matrix on transient dependency audit failures.

---

Codex Task

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c1b949f7b9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Handle invalid exclude dirs inside analyze input try-block

Move validate_extra_ignore_dirs() into the existing try/except in analyze(), otherwise malformed entries (for example "../tmp") raise ValueError after the handler and return a 500 instead of a controlled 400/422 response. This breaks the new hardening path for exactly the invalid-input case it is meant to handle.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Guard non-integer rate-limit env values

Parsing PROJECT_PROMPTER_ANALYZE_RATE_LIMIT_PER_MIN with a bare int() means any non-numeric deployment value causes every analyze request to fail with a ValueError path. Because this is configuration-driven and affects all users until fixed, the parser should catch conversion errors and fall back to a safe default (or fail fast at startup with a clear operator-facing message).

Useful? React with 👍 / 👎.