ci: read-only GITHUB_TOKEN for backend and frontend CI (#13)

CodeQL actions/missing-workflow-permissions #1-#3: neither workflow writes through GITHUB_TOKEN (checkout, toolchain, cache, upload-artifact).

.github/workflows/backend-ci.yml

@@ -16,6 +16,11 @@ on:
 env:
   CARGO_TERM_COLOR: always
 
+
+# Read-only token: no step writes through GITHUB_TOKEN.
+permissions:
+  contents: read
+
 jobs:
   check:
     runs-on: ubuntu-latest

.github/workflows/frontend-ci.yml

@@ -13,6 +13,11 @@ on:
       - '.github/workflows/frontend-ci.yml'
   workflow_dispatch:
 
+
+# Read-only token: no step writes through GITHUB_TOKEN.
+permissions:
+  contents: read
+
 jobs:
   lint-and-test:
     runs-on: ubuntu-latest