security: Fix command injection vulnerability in updater.py

- Add shlex.quote() on all path arguments before subprocess calls (lines 404-407)
- Consolidate duplicated version_compare() function into single module-level utility
- Remove three identical class methods from UpdateCheckThread, LocalPendingUpdateCheckThread, and UpdateManager
- Add comprehensive test suite for updater.py security-critical functionality
- Add requirements-dev.txt with pytest dependency

Addresses critical security findings from flares_audit_report.md:
  S001: Command Injection in Updater (CVSS ~7.5)
  Q001: Duplicated version_compare logic
  T001: Insufficient test coverage for updater.py

tests/README.md

@@ -0,0 +1,43 @@
+# Test Suite
+
+This directory contains automated tests for the FLARES project.
+
+## Directory Structure
+
+```
+tests/
+├── unit/          # Unit tests for individual modules
+│   ├── test_updater.py      # Security-critical updater module tests
+│   └── ... (more tests TBD)
+├── integration/   # Integration tests for multi-component workflows
+└── fixtures/      # Test data and mock resources
+```
+
+## Running Tests
+
+```bash
+# Install development dependencies
+pip install -r requirements-dev.txt
+
+# Run all unit tests
+pytest tests/unit/ -v
+
+# Run specific test file
+pytest tests/unit/test_updater.py -v
+
+# Run with coverage
+pytest --cov=src tests/ -v
+```
+
+## Test Coverage Goals
+
+- `updater.py`: 100% (security-critical)
+- Core modules: >80%
+- Overall project: >60% (initial target)
+
+## Writing Tests
+
+See existing tests in `tests/unit/test_updater.py` for examples of:
+- Testing utility functions like `version_compare()`
+- Mocking external dependencies (QThread, HTTP requests)
+- Security-focused test cases