chore(security): resolve CodeQL findings — unbiased voucher RNG, linear email check, rate-limit query filter (v0.17.2-beta)

Address the open CodeQL code-scanning alerts:
- guestWifi voucher codes now use rejection sampling so the character
  distribution is uniform (fixes js/biased-cryptographic-random).
- Scheduled-report recipient validation replaced the backtracking email regex
  with a linear split-based check (fixes js/polynomial-redos).
- Add .github/codeql/codeql-config.yml excluding js/missing-rate-limiting:
  rate limiting is applied globally via app.use('/api', rateLimitRedis) plus
  per-route limiters, which CodeQL can't attribute to individual handlers, so
  that rule fired ~38 false positives.

Remaining alerts are dismissed as accepted/false-positive (RouterOS MD5 API
login and self-signed cert acceptance are protocol-mandated; log sites already
strip CRLF).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/codeql/codeql-config.yml

@@ -0,0 +1,10 @@
+name: "MikroTik Manager CodeQL config"
+
+# Rate limiting is enforced globally in Express — `app.use('/api', rateLimitRedis(...))`
+# in backend/src/index.ts, plus dedicated limiters on auth/login/TOTP/OIDC routes.
+# CodeQL's data flow can't attribute a global app-level middleware to each individual
+# route handler, so `js/missing-rate-limiting` fires on ~every DB/fs handler as a false
+# positive. Exclude it rather than carry dozens of non-actionable "high" alerts.
+query-filters:
+  - exclude:
+      id: js/missing-rate-limiting

.github/workflows/codeql.yml

@@ -33,6 +33,8 @@ jobs:
           languages: ${{ matrix.language }}
           # CodeQL queries to run — security-extended adds more security checks
           queries: security-extended
+          # Filters out non-actionable rules (see file for rationale)
+          config-file: ./.github/codeql/codeql-config.yml
 
       - name: Autobuild
         uses: github/codeql-action/autobuild@v4