chore: add CodeRabbit configuration

[frederikprijck]

Summary

• Add .coderabbit.yaml with review guidance tailored to a modern TypeScript-based Express authentication SDK.
• The config is organized into two parts so it can be shared across our sibling TS auth SDKs:
  • [BASELINE] — generic to any TS auth SDK: review behavior, path filters, TS/ESM rules, an auth security review block (secrets/token leakage, cookie flags, state/nonce/PKCE, open redirects, token validation, timing-safe comparison, prototype pollution, fail-closed auth), test/example/CI guidance, and tools.
  • [EXPRESS] — repo-specific: cookie maxAge ms/seconds conversion, next(err) middleware handling, OAuth/OIDC handler lifecycle, and AsyncLocalStorage store null-safety.
• Enables eslint, gitleaks, semgrep, actionlint, markdownlint, languagetool; excludes dist/, coverage/, *.d.ts, and the lockfile; skips release PRs.

Reuse

Sibling SDKs can copy the [BASELINE] entries verbatim (or lift them into org-level CodeRabbit config) and replace the [EXPRESS] block. Globs referencing packages/**/src may need adjusting to the target repo's layout.

Test plan

• Confirm CodeRabbit picks up .coderabbit.yaml on this PR and posts a review.
• Verify no schema-validation warnings on the tools / knowledge_base keys.

[nandan-bhat]

This packages/**/src/**/*.ts path is the same glob already used at line 62 for the security block. path_instructions is an array so it's valid, but do we know if CodeRabbit merges instructions when two entries share a glob, or is it last one wins ? If it's last wins, the big security block loses its glob and all package source only gets this one maxAge line. Safer to fold this line into the security block, or give it a more specific glob.

[nandan-bhat]

Just flagging the combo is intended: profile: assertive means more comments, and request_changes_workflow: false means it never blocks. Fine for an advisory bot, just confirming that's the goal.