ci: scope CodeQL to shipped security surfaces

[Draek2077]

Summary

• add a JavaScript/TypeScript CodeQL workflow for main, pull requests, weekly scheduling, and manual dispatch
• apply the repository CodeQL configuration to the workflow
• exclude only non-shipped tests, demos, capture harnesses, and vendor documentation while retaining shipped runtime code

Verification

• npm run build:server
• npm run typecheck
• npm run lint
• npm run format
• YAML parsing and git diff --check