chore(bestpractices): embed URLs inline + resolve SUGGESTED ? placeho… #22

Job	Run time
OSV-Scanner (SCA)	5s
jscpd (duplication < 3% on touched code)	13s
SBOM (SPDX + CycloneDX)	10s
Gitleaks (secret scan)	11s
Semgrep (SAST)	34s
Trivy (filesystem + container scan)	46s
	1m 59s

Provide feedback