Add SAST scanning to CI pipeline

[AbelOsaretin]

What

The CI workflow only runs npm test. No static analysis security testing (SAST) is performed. Common vulnerabilities go undetected.

Why

SAST tools catch security issues at code time before they reach production. Without them, vulnerabilities accumulate silently.

Scope

• Add Semgrep or CodeQL to CI workflow
• Configure for TypeScript/Node.js
• Run on every PR
• Fail on high/critical findings

Acceptance Criteria

• SAST tool configured in .github/workflows/ci.yml
• Runs on every PR
• Fails CI on high/critical vulnerabilities
• Reports are visible in PR checks

Technical Context

• .github/workflows/ci.yml — current CI pipeline
• Semgrep has a free tier for open source
• CodeQL is free for public repos