chore: harden public repository health

[atk0309]

What changed

• add a Code of Conduct, issue forms, and a pull-request template
• add a scheduled and pull-request CodeQL workflow for Python and JavaScript/TypeScript
• align Starlette TestClient typing with httpx2 and update the backend lockfile
• disable unused experimental Node web storage in Next.js and Vitest processes
• document the public-repository health, deployment, and testing changes

Why

The public repository had green baseline CI but incomplete community health metadata, no CodeQL analysis, stale TestClient response typing, and noisy Node 26 web-storage warnings. This patch makes the public project easier to contribute to and gives security and compatibility checks explicit, reviewable homes.

Impact

There is no intended product-behaviour or rendering change. Contributors get structured issue/PR guidance, maintainers get CodeQL coverage, and local/test output is cleaner on the pinned Node toolchain.

Validation

• node scripts/quality-gate.mjs --fail-on-gap — PASS on the exact 20-file patch
• backend: 327 passed, 13 intentional skips
• frontend: 340 passed
• production frontend build — PASS
• backend/frontend runtime smoke checks — PASS
• pnpm audit --audit-level=moderate — no known vulnerabilities
• pip-audit — no known vulnerabilities
• actionlint and Docker build checks — PASS
• pre-push guidance, invariant, and doc-impact checks — PASS

Known risks or follow-ups

• CodeQL is new and must complete successfully on this PR before merge.
• Three backend concurrency tests remain intentionally Postgres-only; GitHub CI supplies Postgres.
• Ten provider live-spike tests remain intentionally gated on real provider credentials.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[atk0309]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

Reviewed commit: 3cc44d5697

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".