Redesign app for GHAS training

[WritingPanda]

This replaces the legacy archive-focused training repo with a realistic local JavaScript application that can demonstrate GitHub Advanced Security features end to end.

Summary

• Rebuilds the project as a local Express expense tracker with SQLite persistence, server-rendered pages, receipt storage, and report export.
• Adds intentional GHAS teaching surfaces for CodeQL, Dependabot, secret scanning placeholders, and Code Quality findings.
• Adds Jest/Supertest coverage with 80% global thresholds, plus CI for tests and coverage.
• Documents the training map and remediation exercises for bootcamp participants.

Notes for reviewers

The security and quality issues are intentional because this repository is meant to produce GHAS findings. CodeQL is expected to use default setup, so no custom codeql.yml workflow is included.