ci(codeql): add static analysis for the TypeScript side

[Clupai8o0]

TCI-06 leftover (web half), from my product-audit pile. Base 11.0.x.

TCI-06 was about CodeQL wiring on the api repo (already fixed on 11.0.x). While verifying it I confirmed the card's other standing item: doubtfire-web has no codeql.yml at all, so the whole TypeScript/Angular side of the product has no static analysis. This adds one.

Built against

• web: 11.0.x @ 1671005a

What changed

New .github/workflows/codeql.yml, copied from the api workflow so the two repos read the same:

• language: ["javascript-typescript"] (the api one is ruby).
• No Autobuild step — JS/TS is extracted directly, no build needed.
• Same triggers as api: push on ["11.0.x", "development"], every PR via pull_request: {}, weekly cron, and the same concurrency block.
• Same SHA-pinned actions: actions/checkout@11d5960 # v4, github/codeql-action/{init,analyze}@6d786de # v3.

It is not wired into branch protection, so it reports as an informational check rather than a required gate until the team decides to require it.

Checks

• actionlint 1.7.12 → 0 issues.
• python3 -c "import yaml; yaml.safe_load(...)" → parses.
• SHA pins are the same 40-char refs the api repo already runs.
• Not covered: the first real run happens on GitHub after merge; a large TS codebase may surface existing alerts, which is the point of adding it.

[Clupai8o0]

Closing without merging. The premise this was built on is wrong: doubtfire-web has no committed codeql.yml, but CodeQL default setup is enabled on the repo, so the TypeScript side is already analysed. This PR triggered it — the run named CodeQL "via dynamic" on this PR has Analyze (actions) and Analyze (javascript-typescript) jobs, which is the default-setup signature (no workflow file produces those job names).

Adding a committed (advanced) workflow on top of default setup is redundant and GitHub will not process the advanced SARIF while default setup is enabled for the same language. The api repo is the opposite — it runs an advanced committed codeql.yml (CodeQL (ruby)), which is why the concurrency PR there (#114) is valid.

So TCI-06's "web has no static analysis" line does not hold. Nothing to do on web. Leaving default setup as-is.