infra: wire security gate into CI and sync API docs

[Chidimj]

Summary

Bundles fixes for four small infra/docs issues:

• [Infra] scripts/verify-security-setup.js is not wired into CI, so it only runs manually #1059 — npm run verify-security was only ever run manually. Added it as a step in .github/workflows/security.yml (dependency-check job) so a broken security setup fails CI. Verified locally: passes clean (6/6) on current config, and exits non-zero (2 failed) when SECURITY.md is deliberately removed.
• [Infra] .github/dependabot.yml only tracks npm ecosystems, missing cargo for the contracts crate #1060 — Checked .github/dependabot.yml: a cargo ecosystem entry for /contracts already exists (merged via fix(ci): point Dependabot npm at the workspace root only #772). No change needed here; noting it in this PR so the issue can be closed as already resolved.
• [Docs] docs/api/flowfi.postman_collection.json is not kept in sync with the OpenAPI/swagger definitions #1061 — Spot-checked docs/api/flowfi.postman_collection.json stream endpoints against the @openapi JSDoc in backend/src/routes/v1/stream.routes.ts and related controllers. The existing entries (create/list/get/events/claimable) already matched. Added the endpoints that were missing entirely (summary, pause, resume, withdraw, cancel, top-up) so the collection covers the full stream lifecycle. Added docs/api/README.md documenting the Swagger spec (backend/src/config/swagger.ts + route JSDoc, served at /api-docs.json) as the source of truth.
• [Docs] SECURITY.md does not link to the vulnerability disclosure form or GitHub Security Advisories flow #1062 — SECURITY.md mentioned GitHub Security Advisories but buried it behind vague "direct contact" wording. Rewrote the "How to Report" section to lead with the GitHub Security Advisories flow and a direct link. CONTRIBUTING.md already cross-links SECURITY.md (Security section), so no change needed there.

Closes #1059
Closes #1061
Closes #1062

(#1060 is already resolved on main via #772 — flagging for maintainers to close.)

Test plan

• node scripts/verify-security-setup.js passes on current config (6/6)
• Confirmed script exits 1 when SECURITY.md is removed (proves the CI gate works)
• node -e "JSON.parse(...)" validates the edited Postman collection is well-formed JSON
• Manually diffed Postman stream endpoints against @openapi annotations in stream.routes.ts, streams/withdraw.ts, controllers/stream/cancel.ts