fix: remove rejectUnauthorized: false — resolve CodeQL certificate validation alert

[Copilot]

CodeQL flagged a high-severity js/disabling-certificate-validation alert (CWE-295/CWE-297): the Cosmos DB emulator setup fell back to rejectUnauthorized: false when the emulator CA cert file was missing, fully disabling TLS validation and opening the door to MITM attacks.

Change

api/src/shared/cosmosdb.ts

• Removed the insecure fallback https.Agent({ rejectUnauthorized: false }) — including its prod-environment guard, which was insufficient mitigation
• When the emulator CA cert is not found, a descriptive error is now thrown and caught by the surrounding try/catch, which logs a clear actionable warning

// Before
} else {
  if (process.env.ENVIRONMENT === 'prod') {
    throw new Error('Cannot disable TLS verification in production environment')
  }
  clientOptions.agent = new https.Agent({ rejectUnauthorized: false }) // ← flagged
}

// After
} else {
  throw new Error(
    `Cosmos DB Emulator CA certificate not found at "${emulatorCertPath}". ` +
    `Run the emulator setup script or set COSMOS_EMULATOR_CERT_PATH to a valid cert file.`
  )
}

TLS validation is now always enforced; developers get an explicit error instead of a silent insecure connection.