fix: resolve all code scanning alerts and add CI checks

[Nerdy-Technician]

Summary

Fixes all 52 open CodeQL code scanning alerts and adds more CI checks.

Security fixes

Collexions worker (collexions/server.py)

• Stack-trace exposure (26 alerts): API responses now return fixed error messages; the exception detail goes to the server log (logging.exception). Plex connectivity errors map to safe categories (timeout / unreachable / SSL) through _describe_request_error, so the health and validation endpoints still say what went wrong.
• Path injection: the SPA catch-all now resolves the requested path and only serves files that stay inside dist/.
• Flask debug: the Werkzeug debugger is off by default. Set FLASK_DEBUG=1 to turn it on.
• URL substring check: mdblist URLs are checked by their parsed hostname instead of 'mdblist.com' in url.
• Cleartext logging: the title-search failure log no longer interpolates item data. _unused/debug_mdblist.py passes the API key as a request param and no longer prints response bodies.

Client / lib

• Creator.tsx (both copies): isMdbListUrl() checks the hostname.
• SettingsDashboard.tsx: request-app links and the splash logo preview go through the new client/shared/safeUrl.ts, which only allows http(s) URLs (plus blob: for the image preview).
• SetupWizard.tsx: API keys, the SMTP password and arr instance keys are no longer written to sessionStorage. The Plex token and non-secret wizard state are still saved, so the OAuth redirect works as before. If the page is reloaded mid-setup, keys have to be entered again.
• lib/discovery-facts.js / DiscoveryFactWidget.tsx: tag stripping repeats until the text stops changing, and script/style end tags with extra whitespace or attributes (e.g. </script >) are now matched.
• build-version.js: all regex metacharacters in the version are escaped.
• tvdbClient.js, screens.tsx: removed no-op replace calls.

Dependencies

• nodemailer ^9 → ^10.0.13 to fix several high-severity advisories. The only breaking change in v10 is requiring Node 20+, and the image uses Node 22.
• Ran npm audit fix, which applied non-breaking fixes for express/body-parser/qs/react-router. The remaining advisories are dev-only (vitepress → vite → esbuild) and have no upstream fix yet.

New CI (.github/workflows/ci.yml)

All actions are pinned by commit SHA.

• Node: npm ci, node --check on server sources, npm run build, npm audit --omit=dev --audit-level=high
• Python: compileall, ruff (syntax errors / undefined names), pip-audit on collexions/requirements.txt
• Docker: image build on PRs, no push
• actionlint: lints every workflow

I left out a dependency-review job because it needs Dependency graph turned on (Settings → Code security). Once that's on, actions/dependency-review-action can be added.

Also adds .github/dependabot.yml for npm, pip, GitHub Actions and Docker.

Testing

• npm run build passes locally and node --check is clean
• python -m py_compile, ruff --select E9,F63,F7,F82 and pip-audit pass
• actionlint passes on all workflows
• npm audit --omit=dev --audit-level=high passes
• nodemailer 10 smoke test (createTransport + sendMail via jsonTransport) passes
• The hostname check rejects evil.com/mdblist.com and mdblist.com.evil.com