ci(sonarqube): add non-blocking SonarQube analysis on push to main

Wire the self-hosted SonarQube server into Gitea via a Gitea Actions
workflow. Runs on push to `main` (post-merge) and workflow_dispatch, so
it feeds the dashboard without gating any PR. Adds sonar-project.properties
(project key runic-gateway-website; server/client/bot sources, server tests,
node_modules/dist/generated excluded).

Requires two one-time Gitea settings: secret SONAR_TOKEN and variable
SONAR_HOST_URL. The scan does not wait on the Quality Gate, keeping it
fully non-blocking.

Co-Authored-By: Claude <noreply@anthropic.com>

sonar-project.properties

@@ -0,0 +1,20 @@
+# SonarQube analysis config for the website repo.
+# Consumed by the scanner in .gitea/workflows/sonarqube.yml on push to main.
+# The project key must match the one created in SonarQube (dashboard URL
+# ?id=runic-gateway-website).
+
+sonar.projectKey=runic-gateway-website
+sonar.projectName=runic gateway website
+
+# Analysed application code. The three npm workspaces (server / client / bot).
+sonar.sources=server/src,client/src,bot/src
+
+# Test code is analysed separately from sources so coverage/metrics attribute
+# correctly. Only the server has a test suite today.
+sonar.tests=server/test
+sonar.test.inclusions=server/test/**/*.test.js
+
+# Never analyse dependencies, build output, generated specs, or runtime dirs.
+sonar.exclusions=**/node_modules/**,client/dist/**,client/public/**,server/swagger/**,server/logs/**,server/uploads/**,**/*.min.js
+
+sonar.sourceEncoding=UTF-8