chore: add lefthook git hooks and polyglot static analysis toolchain

[BillyOutlast]

Summary

Adds a two-layer quality-gate setup for the polyglot monorepo: fast local hooks at commit/push, authoritative scans in CI. Nothing in CI depends on a hook having run — hooks are early feedback, CI is the authority.

Layer	When	What
lefthook pre-commit	commit	prettier + eslint --fix on staged files, ast-grep scan, gitleaks (<10s)
lefthook pre-push	push	server typecheck, per-crate clippy, golangci-lint, knip report
GitHub Actions	PR/push	gitleaks history scan, cargo-audit ×7 crates, golangci-lint (Go backend)
GitHub Actions	weekly	semgrep deep scan → SARIF → Code Scanning

What's included

• lefthook as a root devDependency wired via "prepare": "lefthook install" — hooks self-install on pnpm install, no brew prerequisite. Glob-filtered so irrelevant commands skip entirely (a markdown-only commit pays ~nothing)
• security.yml — gitleaks full-history scan via direct CLI (gitleaks-action requires a paid license for organization repos), cargo-audit matrix across all 7 Rust crates with on-the-fly lockfile generation for vendored crates that gitignore theirs, golangci-lint job for the previously-unlinted Go backend
• semgrep-scheduled.yml — weekly deep scan uploaded to Code Scanning; deliberately not in push/PR CI where its runtime would hurt
• knip report-only step in Server CI (non-blocking during rollout), with workspace-aware knip.json
• ast-grep starter rules (sgconfig.yml + rules/): no-console-log (server TS/Vue), no-fmt-println (Go)
• backend/.golangci.yml (v2 syntax) with gosec + core linters
• Shared root .prettierrc.json (copied from server/)
• CLAUDE.md documenting what runs when, escape hatches, native binary install paths, and machine-readable output commands for AI agents

Rollout philosophy

Deliberately non-disruptive — each gate starts in warn/report mode with a recorded baseline in CLAUDE.md:

• knip: report-only (baseline: 117 unused files / 31 unused exports / 4 unused deps)
• golangci-lint: --new-from-rev=origin/develop new-issues-only
• ast-grep rules: severity: warning

Each has a documented flip-to-strict path once triaged. The clippy pre-push hook skips desktop/src-tauri locally (needs Tauri system libs) but CI covers it.

Verification

$ pnpm exec lefthook validate
All good
$ pnpm exec lefthook run pre-commit --all-files   # ~5s wall
✔️ gitleaks ✔️ ast-grep ✔️ eslint ✔️ prettier
$ cd server && pnpm run typecheck && pnpm run build   # clean

Negative-tested: a staged fake API key fails pre-commit via gitleaks.