Evaluate and integrate CodeRabbit OSS and SonarQube Cloud

### Description

Run a time-boxed spike on CodeRabbit’s open-source offering and SonarQube Cloud for this public repository, then implement the selected tool configurations. The goal is useful, low-noise pull-request feedback and code-quality visibility that complement CodeQL, linting, type checks, and tests.

### Action Items

- [ ] Confirm public-repository eligibility, pricing, data-access implications, and required organization permissions for both tools.
- [ ] Define evaluation criteria: feedback relevance, false-positive rate, pull-request experience, configuration effort, run-time impact, and ongoing maintenance.
- [ ] Evaluate CodeRabbit OSS on representative pull requests and record findings.
- [ ] Evaluate SonarQube Cloud on representative pull requests and record findings.
- [ ] Compare overlap and complementarity with CodeQL, ESLint, TypeScript, and the unit-test work.
- [ ] Decide which tool or tools meet the evaluation criteria and document the rationale.
- [ ] Implement the approved CodeRabbit configuration, including repository-specific review guidance and safe access scope.
- [ ] Implement the approved SonarQube Cloud project, analysis workflow, pull-request decoration, and initial quality profile.
- [ ] Review and triage the initial findings; create follow-up issues for actionable remediation.
- [ ] Document contributor expectations, ownership, alert/review handling, and whether any resulting checks should become required merge gates.

### Additional Information

Implementation follows the spike decision; do not make either tool a required merge gate until the initial feedback baseline has been reviewed.

Related: #741 covers CodeQL security scanning. This Task evaluates AI PR review and broader static code-quality analysis, which may complement CodeQL rather than replace it.