TypeScript: implement Knex, Kysely, Objection.js, and raw SQL sink extraction

[bjcorder]

Parent

Part of #89.

Context

Many TypeScript apps use query builders or driver-level SQL instead of a full ORM. Rulepath should conservatively detect business-invariant violations in Knex, Kysely, Objection.js, and raw SQL without trying to replace SQL injection tools.

References:

• Knex query builder: https://knexjs.org/guide/query-builder.html
• Kysely: https://www.kysely.dev/
• Objection.js: https://vincit.github.io/objection.js/

Scope

• Detect Knex query-builder operations: table calls, select, where, insert, update, delete, del, returning, transaction, and raw queries.
• Detect Kysely operations: selectFrom, insertInto, updateTable, deleteFrom, where, set, values, transaction, and raw SQL fragments.
• Detect Objection.js model/query operations: query, findById, findOne, insert, patch, update, delete, deleteById, relation queries, and transactions.
• Detect raw SQL through node-postgres, mysql2, better-sqlite3, mssql, Slonik-like helpers, template tags, and driver query/execute APIs where practical.
• Extract resource/table/model, operation type, filters, mutation fields, bulk flag, spans, normalized sink expression, and transaction evidence.
• Track request-controlled values into filters, bindings, parameter arrays/objects, template expressions, update sets, insert values, and raw SQL parameters.
• Treat unresolved dynamic SQL as low-confidence review hints unless high-confidence sink details are available.

Acceptance Criteria

• Query-builder/raw SQL unsafe fixtures emit expected findings for unscoped access and unsafe mutations.
• Scoped parameterized queries avoid unscoped findings when tenant/object filters are present.
• Dynamic SQL produces cautious confidence behavior and review hints where appropriate.
• This support focuses on Rulepath invariants, not SQL injection replacement.

Test Plan

• Add unit tests for Knex, Kysely, Objection.js, and raw SQL operation/filter/mutation extraction.
• Add fixtures for Hono/Fastify/Koa using Knex/Kysely/raw SQL safe and unsafe cases.
• Assert JSON source IDs and sink metadata.
• Run cargo fmt --all -- --check, cargo clippy --locked --workspace --all-targets, and cargo test --locked --workspace.