ci(sonar): add .sonarcloud.properties so Automatic Analysis honors the i18n cpd exclusion (#58)

Fixes #57. Automatic Analysis ignores sonar-project.properties (CI
scanners only) and offers no Analysis Scope page in the web UI — its
supported configuration channel is this dot-file on the default branch.
Carries the same two settings: the src/i18n/** duplication exclusion
(parallel locale dictionaries are the architecture, PRD D4/FR-7) and
the advisory-only workflow-rule suppressions.

Author: eaitbrahim

.sonarcloud.properties

@@ -0,0 +1,26 @@
+# SonarCloud Automatic Analysis configuration (#57).
+#
+# Automatic Analysis does NOT read sonar-project.properties (that file is
+# for CI-based scanners); it reads THIS file, and only from the default
+# branch. Keep the two in sync if a CI scanner is ever added.
+#
+# The i18n dictionaries (src/i18n/**) are deliberately parallel: every
+# locale block mirrors the same keys with translated prose (PRD D4/FR-7 —
+# EN is the source of truth, AR/FR tracked by revision markers). Duplication
+# analysis normalizes string literals, so that parallelism reads as
+# copy-paste; it is the architecture, not debt.
+sonar.cpd.exclusions=src/i18n/**
+
+# Narrow exclusions, advisory-only GitHub-Actions hardening rules on
+# workflow files. The substantive fixes are in the workflows (npm ci
+# --ignore-scripts, pinned wrangler, local-bin astro, file-based parse in
+# custom-domain.yml); what remains of these three rules is policy
+# preference, not defect. All other rules — including script-injection
+# rules on the same files — stay on.
+sonar.issue.ignore.multicriteria=e1,e2,e3
+sonar.issue.ignore.multicriteria.e1.ruleKey=githubactions:S6505
+sonar.issue.ignore.multicriteria.e1.resourceKey=.github/workflows/**
+sonar.issue.ignore.multicriteria.e2.ruleKey=githubactions:S8543
+sonar.issue.ignore.multicriteria.e2.resourceKey=.github/workflows/**
+sonar.issue.ignore.multicriteria.e3.ruleKey=githubactions:S8482
+sonar.issue.ignore.multicriteria.e3.resourceKey=.github/workflows/**