pre-commit: bandit hook fails (exit 2) — missing .bandit-baseline.json

Part of #213.

## Problem

The `bandit` pre-commit hook is configured with `args: [--baseline, .bandit-baseline.json]`, but `.bandit-baseline.json` does not exist in the repository. Bandit therefore exits with code **2** (an operational error, not a security finding):

```
[main] WARNING Could not open baseline report: .bandit-baseline.json
```

This fails on any file (reproduced on unrelated existing files such as `tools/validate-size.py`), so it is unrelated to any specific change.

Note: the CI security gate uses `mise run security:bandit` (`bandit -r . -x ...`), which does **not** use a baseline and passes cleanly — so this only affects the local pre-commit hook.

## Reproduce

```bash
mise exec -- pre-commit run bandit --files tools/validate-size.py
```

## Proposed fix

Either (a) generate and commit a `.bandit-baseline.json` (`bandit -r . -f json -o .bandit-baseline.json`), matching the pattern used for `.gitleaks-baseline.json`, or (b) drop the `--baseline` arg from the bandit hook in `.pre-commit-config.yaml` if a baseline is not desired.

_{Filed with assistance from Claude Code while implementing #211.}

Start in .pre-commit-config.yaml and inspect the bandit hook's --baseline configuration; reproduce it with `mise exec -- pre-commit run bandit --files tools/validate-size.py`. Choose and document the repository's intended baseline approach, then verify the hook completes successfully on the example file without the missing-baseline error.

Written by the indexing model from the issue text.