ci: add CodeQL analysis

[rowkav09]

What changed

• add CodeQL analysis for JavaScript/TypeScript
• run on relevant PRs, main changes and a weekly schedule
• use security-extended queries with a 15-minute bound
• keep default workflow permissions read-only and grant security-events: write only to the analysis job

Why

The hosted HTTP service and updater process untrusted external data. CodeQL adds dataflow and injection analysis beyond syntax and unit tests.

Checks

• Workflow syntax reviewed
• Permissions are job-scoped and least-privilege
• No secrets, tokens, server URLs, or personal media data are committed
• The change is scoped to one roadmap issue

Issue

Refs #127

[mira-reviewer-rk]

Mira PR Walkthrough

---

❌ Review failed — click for details

The code review failed to complete due to an unexpected error.

Stage: Code review
Error type: LLMError
Message: LLM tool-call failed

[rowkav09]

/mira mute

[rowkav09]

Closing for now: code scanning isn't enabled on this private repo (the CodeQL run fails with 'Code scanning is not enabled for this repository'). It needs GitHub Advanced Security while the repo is private. Worth reopening once nowplaying is public. Still tracked in #127.