ci(security): add CodeQL static analysis workflow

[yunus-dev-codecrafter]

closes #350

Summary

• Added CodeQL static analysis GitHub Actions workflow targeting the javascript-typescript CodeQL pack for the TypeScript source tree (src/), including the 2251-line routing engine at src/index.ts.
• Workflow fires on push/pull_request to main (path-scoped to src/** and CodeQL config files) plus a weekly Monday 04:37 UTC scheduled scan for dormant issues.
• Analysis scope defined in .github/codeql/codeql-config.yml: includes src/, excludes src/**/__tests__/**, **/node_modules/**, **/dist/**, and **/coverage/**.
• Workflow runs queries: security-and-quality covering injection, XSS, prototype pollution, hardcoded secrets, unsafe deserialization, and clear-text logging rules against the compiled TypeScript via the CodeQL autobuild step.
• SARIF results are uploaded to the GitHub Security tab (security-events: write permission) and additionally archived as a 30-day retention artifact for offline triage.
• Added comprehensive structural/invariant tests (src/__tests__/ciWorkflow.test.ts, 28 passing tests) validating triggers, matrix, permissions, step ordering, path filters, scoping rules, cron format, and ci.yml non-regression.
• Installed js-yaml@5.2.2 + @types/js-yaml@4.0.9 as devDependencies for YAML parsing in the workflow tests.
• Extended docs/CI.md with a full CodeQL section covering: trigger conditions, scope, permissions, triage workflow (true-positive/false-positive/won't-fix classification and UI dismissal reasons), comment suppression patterns, 30-day open-alert SLA, local CodeQL CLI reproduction commands, and a common JS/TS rule/CWE reference table.

Related Issue

Closes #350

Validation

• npm run build
• npm run lint
• npm test

Checklist

• I kept the change focused on the linked issue.
• I added or updated tests for behavior changes.
• I updated documentation when commands, API behavior, or setup changed.
• I did not commit secrets, tokens, .env files, or private credentials.

Security Notes

• The analyze job uses the minimum required GitHub token permissions: security-events: write (to post SARIF), actions: read, contents: read. No broader repo scope is requested.
• Only src/ production code is analyzed; tests, build output, coverage, and third-party node_modules are explicitly excluded from the CodeQL database to avoid noisy/irrelevant findings on vendored code.
• The workflow runs security-and-quality queries (both default javascript-queries and experimental extended taint/data-flow rules). Experimental findings may have a slightly higher false-positive rate; the triage guide in docs/CI.md documents the UI dismissal flow + required justification comments to prevent blind suppressions.
• Comment-based inline suppressions (// codeql[...]) are explicitly documented as a secondary option behind UI dismissal and require security-team sign-off. No suppressions were added in this PR.
• No new network egress, environment variables, or runtime dependencies are introduced into the application itself; changes are purely CI-time static analysis (dev-only js-yaml types + parser).
• The weekly scheduled scan (37 4 * * 1, off-peak Monday UTC) detects supply-chain regressions in dependencies or dormant patterns even when no push/PR activity occurs.
• SARIF artifacts are retained for 30 days (not public) for auditable triage history; longer retention can be configured if compliance requirements change.

---

**Code references used in the Summary above:**

- Workflow file: [codeql.yml](file:///c:/Users/yunus/Desktop/Stableroute-backend350/.github/workflows/codeql.yml)
- Scope/exclusions config: [codeql-config.yml](file:///c:/Users/yunus/Desktop/Stableroute-backend350/.github/codeql/codeql-config.yml)
- Structural tests (28 passing): [ciWorkflow.test.ts](file:///c:/Users/yunus/Desktop/Stableroute-backend350/src/__tests__/ciWorkflow.test.ts)
- Triage + rules docs: [CI.md](file:///c:/Users/yunus/Desktop/Stableroute-backend350/docs/CI.md#L20-L175)
- Dev dependencies added: [package.json lines 35 and 42](file:///c:/Users/yunus/Desktop/Stableroute-backend350/package.json#L35-L42)
- Large target file covered by scope: [index.ts](file:///c:/Users/yunus/Desktop/Stableroute-backend350/src/index.ts)

[mikewheeleer]

nice one — thanks for picking it up 🙌