ci(codeql): run code scanning on every PR

[eliteprox]

What this PR does

• adds .github/workflows/codeql.yml
• runs CodeQL on every PR targeting main
• runs CodeQL on pushes to main
• adds a weekly scheduled scan plus manual dispatch
• grants security-events: write for code scanning uploads

Why

Enable GitHub Advanced Security CodeQL scans for all incoming PRs so security findings surface before merge.

Local validation

• pnpm typecheck: pass
• Snyk Code scan on repo executed (3 existing medium findings in unrelated files; no findings from this workflow change)
• SonarQube project lookup executed; no console project key available in current Sonar org/account, so repo-specific Sonar validation could not be run in this environment

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
console	Ready	Preview	Sep 5, 2026 5:38am UTC