TypeScript: implement TypeORM sink extraction

[bjcorder]

Parent

Part of #89.

Context

TypeORM is a major TypeScript ORM used in NestJS and standalone apps. Rulepath needs to identify repository/entity-manager/query-builder operations, filters, mutations, transactions, and request-controlled data flows.

Reference: https://typeorm.io/

Scope

• Detect repositories, DataSource, EntityManager, active-record entities, and injected repositories where statically resolvable.
• Detect read operations such as findOne, findOneBy, find, findBy, getOne, getMany, query builder selects, and raw query calls.
• Detect mutations such as save, insert, update, upsert, delete, remove, softDelete, query builder update/delete, and transaction operations.
• Extract resource/entity/table, operation type, method, filters, mutation fields, bulk flag, spans, normalized sink expression, and transaction evidence.
• Track request-controlled IDs and DTO/body fields into repository options, where objects, query builder parameters, entity assignment, and service parameters.
• Recognize tenant/object scope filters, current-user/current-tenant helpers, and authorization evidence.

Acceptance Criteria

• TypeORM unsafe fixtures emit INV001, INV002, INV003, and INV006 where appropriate.
• Safe fixtures recognize tenant-scoped queries, object authorization, policy checks, and allowlisted mapping.
• Query builder update/delete and raw query paths use cautious confidence behavior.
• Stable fingerprints use semantic sink identity rather than fragile line numbers.

Test Plan

• Add ORM unit tests for repository, entity manager, active record, query builder, transactions, and raw query patterns.
• Add NestJS/TypeORM or Fastify/TypeORM fixtures for safe and unsafe cases.
• Assert JSON sink metadata, source IDs, and call path frames.
• Run cargo fmt --all -- --check, cargo clippy --locked --workspace --all-targets, and cargo test --locked --workspace.