Run CodeQL against the TypeScript tree

Static analysis was the one class of check the pipeline had no answer for:
lint catches style, the type checker catches shape, the tests catch
behaviour, and nothing walked the data flow from an untrusted input to a
sink. This is GitHub's default setup written out as a workflow file, so the
query suite, the excluded paths and the schedule sit in the diff rather
than behind a settings toggle.

Pull requests and a weekly run on the default branch. No push trigger:
everything reaches main through a pull request that was already analysed,
and the weekly run is what keeps the Security tab current.

src/generated is excluded. Extracting the 9 MB Prisma client costs minutes
and can produce nothing anyone would act on, because the fix for anything
found in there is to regenerate it.

.github/workflows/codeql.yml

@@ -0,0 +1,73 @@
+name: CodeQL
+
+# Static analysis for the TypeScript tree. This is GitHub's default setup
+# expressed as a workflow file rather than enabled from the repository
+# settings, so the query suite, the excluded paths and the schedule are
+# reviewable in the diff like everything else here.
+#
+# Deliberately NOT on `push: main`. The weekly run already analyses the
+# default branch, which is what keeps the Security tab current, and every
+# change reaches `main` through a pull request that is analysed on the way
+# in. Adding a push trigger would analyse the same tree a second time
+# minutes later for no additional signal.
+on:
+  pull_request:
+    branches: [main]
+  schedule:
+    # Mondays, 04:27 UTC. Off the hour so the run does not queue behind
+    # everyone else's midnight cron.
+    - cron: "27 4 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: codeql-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyse javascript-typescript
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      # Required to write the results into the repository's code-scanning
+      # alerts. Free for public repositories.
+      security-events: write
+      # Required by the CodeQL action to read workflow run metadata.
+      actions: read
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      # `build-mode: none` is the correct mode for JavaScript/TypeScript —
+      # CodeQL extracts from source and needs neither a compile step nor
+      # installed dependencies.
+      #
+      # The excluded paths are all generated or vendored output. Chief
+      # among them is `src/generated`, the ~9 MB Prisma client with a
+      # 224 KB inline schema literal in it: extracting that costs real
+      # minutes and can produce nothing actionable, because nobody edits
+      # it and the fix for anything found there is `pnpm prisma generate`.
+      - name: Initialise CodeQL
+        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        with:
+          languages: javascript-typescript
+          build-mode: none
+          config: |
+            paths-ignore:
+              - src/generated
+              - .next
+              - dist
+              - coverage
+              - playwright-report
+              - test-results
+              - public
+
+      - name: Analyse
+        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        with:
+          category: "/language:javascript-typescript"