ci: add CodeRabbit configuration for template-ui

[NP-compete]

Closes #155

Summary

• Add .coderabbit.yaml with assertive profile for correctness-only automated reviews
• Add 6 ast-grep rules for TypeScript/React patterns: no console.log, no dangerouslySetInnerHTML (XSS), no useEffect without deps, no direct process.env, no explicit any types, no floating promises
• Configure auto review with draft/bot exclusions, slop detection, post-merge changelog, issue enrichment with auto-labeling, and cross-repo knowledge base (template-agent, template-mcp)

This PR targets main so CodeRabbit picks up the config from the default branch.

Test plan

• Verify CodeRabbit triggers on new PRs after merge
• Confirm ast-grep rules fire on matching patterns
• Check slop detection flags AI-generated content

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds a complete CodeRabbit configuration with review defaults, automation, path-based instructions, lint and security tooling, changelog updates, chat replies, issue enrichment, knowledge sources, and guideline patterns. Adds six TypeScript rules covering explicit any, console.log, dangerouslySetInnerHTML, direct environment access, dependency-less useEffect, and unhandled promises.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description check	✅ Passed	The description directly explains the CodeRabbit configuration and six TypeScript/React rules.
Linked Issues check	✅ Passed	The description references issue #155 with a closing keyword.
Out of Scope Changes check	✅ Passed	All changes support the stated CodeRabbit configuration objectives.
Title check	✅ Passed	The title clearly identifies the addition of the CodeRabbit configuration for template-ui.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

🚀 Post-Merge Actions

• Update changelog

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.coderabbit.yaml:
- Line 44: Update the dotenv exclusion pattern in the ignore configuration from
the root-only form to a recursive pattern that excludes matching .env files in
all directories, using !**/.env*.

In @.coderabbit/rules/no-console-log.yml:
- Around line 3-10: Remove the access-token logging statement from the client
router around the token log at line 30, rather than replacing console.log with a
structured logger. Preserve the surrounding request and authentication behavior
while ensuring the token value is never logged.

In @.coderabbit/rules/no-unhandled-promise.yml:
- Around line 6-18: Replace the structural AST pattern in the
no-unhandled-promise rule with a type-aware floating-promise check that
identifies calls returning promises without requiring then, catch, or finally
handling. Ensure it covers async arrow callbacks as well as async function
declarations, while excluding intentional void-returning calls such as
logger.info().

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: a9926e80-64a1-46ab-a5f5-69334bb62168

📥 Commits

Reviewing files that changed from the base of the PR and between 582750b and fb54e8e.

📒 Files selected for processing (7)

• .coderabbit.yaml
• .coderabbit/rules/no-any-type-annotation.yml
• .coderabbit/rules/no-console-log.yml
• .coderabbit/rules/no-dangerously-set-innerhtml.yml
• .coderabbit/rules/no-direct-env-access.yml
• .coderabbit/rules/no-empty-useeffect-deps.yml
• .coderabbit/rules/no-unhandled-promise.yml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• redhat-data-and-ai/template-agent (manual)
• redhat-data-and-ai/template-mcp (manual)

[vishnusrichand]

LGTM