TypeScript: implement Sequelize sink extraction

[bjcorder]

Parent

Part of #89.

Context

Sequelize remains a major Node/TypeScript ORM. Rulepath needs to analyze model queries, updates, deletes, saves, transactions, and request-controlled field flows.

Reference: https://sequelize.org/docs/

Scope

• Detect Sequelize models, model classes, sequelize.define, initialized models, repositories/services, and model imports where statically resolvable.
• Detect read operations such as findByPk, findOne, findAll, findAndCountAll, and query methods.
• Detect mutations such as create, build + save, instance update, static update, destroy, bulkCreate, upsert, and raw queries.
• Extract resource/model/table, operation type, method, filters, mutation fields, bulk flag, spans, normalized sink expression, and transaction evidence.
• Track request-controlled IDs and body/DTO fields into where, dataValues, update objects, create payloads, instance assignment, and raw query replacements/bind params.
• Recognize tenant/object scope filters and authorization evidence.

Acceptance Criteria

• Sequelize unsafe fixtures emit expected findings for unscoped access, unsafe create/update fields, and bulk mutations.
• Safe fixtures recognize tenant-scoped where clauses, authorization evidence, and allowlisted mapping.
• Instance mutation plus save is modeled as a mutation sink.
• Raw query support is cautious and does not replace SQL injection tools.

Test Plan

• Add ORM unit tests for model CRUD, instance save/update/destroy, bulk operations, transactions, and raw queries.
• Add NestJS/Fastify/Sequelize or Koa/Sequelize fixtures for safe and unsafe cases.
• Assert JSON sink metadata and source IDs.
• Run cargo fmt --all -- --check, cargo clippy --locked --workspace --all-targets, and cargo test --locked --workspace.