chore(security): scope CodeQL to shipped product code (#201)

CodeQL flagged 459 alerts on main, but triage showed the bulk are in code
that never ships in the installer's runtime path: file-not-closed in the
omnivoice/eval harnesses, unused-global "FPs" in alembic migration boilerplate
(revision/down_revision), bind-all in tests, and path sinks in the legacy
Gradio research UI. They drowned out the handful of real findings.

Add a CodeQL config (inline, supported because build-mode is `none`/interpreted)
that scopes analysis to product code via paths-ignore: omnivoice/eval, research,
tests, backend/migrations, and *.test.* files. Queries move into the inline
config so security-and-quality stays the single source of truth alongside
paths-ignore.

Net effect on the next scan: the non-shipped-code alerts auto-resolve, leaving
the security tab focused on shipped backend + frontend. No product code changes.

Deliberately NOT touched (assessed, left as-is):
- Stack-trace-exposure (detail=str(e) in routers) — these are intentional,
  helpful one-line diagnostics (the error-transparency work in b64f53b).
  Genericizing them on a loopback/single-user app would regress a product value
  for ~zero real benefit.
- "Critical" command-injection in exports.py and the high path-injections in
  settings.py / system.py — design-correct false positives: list-form argv (no
  shell), and the destination/model-dir/ffmpeg paths are arbitrary user-chosen
  paths by design (containment guards would break the features). Best handled by
  dismiss-with-justification, not code surgery.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/security.yml

@@ -79,7 +79,26 @@ jobs:
           languages: ${{ matrix.language }}
           # Both targets are interpreted — no compiled build step needed.
           build-mode: none
-          queries: security-and-quality
+          # Scope analysis to shipped product code. The excluded trees never
+          # ship in the installer's runtime path and produce the bulk of the
+          # note-level + false-positive findings (file-not-closed in eval
+          # harnesses, unused alembic migration globals, bind-all in tests,
+          # path sinks in the legacy Gradio research UI). Queries live in the
+          # inline config so there's a single source of truth next to
+          # paths-ignore. paths-ignore is supported here because build-mode is
+          # `none` (interpreted analysis).
+          config: |
+            queries:
+              - uses: security-and-quality
+            paths-ignore:
+              - omnivoice/eval
+              - research
+              - tests
+              - backend/migrations
+              - "**/*.test.js"
+              - "**/*.test.jsx"
+              - "**/*.test.ts"
+              - "**/*.test.tsx"
 
       - name: Analyze
         uses: github/codeql-action/analyze@v3