Add CodeQL workflow for multi-language analysis (blocked by repository default setup)

[Copilot]

Repository has GitHub's default CodeQL setup enabled in Settings, which blocks custom workflows. Workflow is correctly configured but cannot process results until repository owner switches to advanced setup.

Changes

Workflow Configuration

• Multi-language matrix: Python (backend/worker), Swift (iOS), JavaScript/TypeScript (web)
• Query suites: security-extended, security-and-quality
• Fixed action path: github/codeql-action/init@v3 (was codeql-init@v3)
• Inline queries parameter (no config file to avoid conflict surface)
• Swift: Manual build with generic simulator, code signing disabled

Documentation

• CODEQL_ACTION_REQUIRED.md - Root-level blocker notice
• .github/CODEQL_SETUP.md - Step-by-step repository setting change
• Workflow comments - Inline warning about repository setting

Blocker

GitHub rejects SARIF uploads with:

CodeQL analyses from advanced configurations cannot be processed 
when the default setup is enabled

Analysis completes successfully; upload is rejected due to repository setting.

Required action (repository owner):
Settings → Security → Code security and analysis → CodeQL analysis (Default) → "..." → Switch to advanced

Alternative: Delete this workflow, keep default setup.

Workflow is production-ready once repository setting is changed.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[smiles0527]

@copilot its faliiling checks

[Copilot]

@copilot its faliiling checks

Fixed in commit 04c6986. The issue was an incorrect action path - changed github/codeql-action/codeql-init@v3 to github/codeql-action/init@v3. The checks should now pass.