TypeScript: implement MikroORM sink extraction

[bjcorder]

Parent

Part of #89.

Context

MikroORM is a major TypeScript data-mapper ORM with entity manager, repositories, unit of work, query builder, and transaction APIs.

Reference: https://mikro-orm.io/docs/

Scope

• Detect MikroORM entities, EntityManager, repositories, injected repositories, and unit-of-work patterns where statically resolvable.
• Detect operations such as findOne, find, findAll, create, assign, persist, persistAndFlush, flush, remove, removeAndFlush, query builder update/delete/select, and transactions.
• Extract resource/entity/table, operation type, method, filters, mutation fields, bulk flag, spans, normalized sink expression, and transaction evidence.
• Track request-controlled IDs and DTO/body fields into filter objects, assignment helpers, entity mutation, query builder params, and service parameters.
• Recognize tenant/object scope filters, authorization evidence, and configured helpers.

Acceptance Criteria

• MikroORM unsafe fixtures emit expected findings for unscoped access, unsafe mutation fields, and missing authorization.
• Safe fixtures recognize scoped filters, policy checks, and safe mapping.
• Unit-of-work flush patterns connect entity mutations to sink diagnostics.
• Query builder bulk update/delete supports INV006.

Test Plan

• Add ORM unit tests for entity manager, repository, unit-of-work, assign/persist/flush, query builder, and transaction patterns.
• Add NestJS/MikroORM or Fastify/MikroORM fixtures for safe and unsafe cases.
• Assert JSON source IDs and sink metadata.
• Run cargo fmt --all -- --check, cargo clippy --locked --workspace --all-targets, and cargo test --locked --workspace.