chore(monorepo): move EDDI-Manager and EDDI-Chat-UI into ui/ and build them with Maven

.gitattributes

@@ -1,11 +1,5 @@
 licenses/** linguist-generated
 
-# Chat UI bundles are built by the separate eddi-chat-ui repo and committed here
-# so the backend ships a matching widget. Reviewing minified output line by line
-# is meaningless -- review the source in eddi-chat-ui instead.
-src/main/resources/META-INF/resources/scripts/js/chat-ui.*.js linguist-generated
-src/main/resources/META-INF/resources/scripts/css/chat-ui.*.css linguist-generated
-src/main/resources/META-INF/resources/assets/** linguist-generated
 
 # Install scripts -- enforce correct line endings per platform
 *.sh text eol=lf
@@ -16,3 +10,8 @@ src/main/resources/META-INF/resources/assets/** linguist-generated
 # execute on Linux and macOS ("bad interpreter"), which would silently disarm the
 # force-push guard for everyone who activated it.
 .githooks/** text eol=lf
+
+# Lockfiles are LF in the index already; pin it so a Windows checkout with
+# core.autocrlf cannot churn them. CRLF normalisation at commit time is what made
+# a committed chat bundle differ byte-for-byte from a fresh build of the same name.
+ui/*/package-lock.json text eol=lf

.github/codeql/codeql-ui.yml

@@ -0,0 +1,15 @@
+# CodeQL configuration for the javascript-typescript analysis (ci.yml `codeql-ui` and the
+# scheduled codeql.yml). It scans the application code that ships in the image: the Manager
+# and Chat UI sources.
+#
+# Everything else is out of scope on purpose, not overlooked:
+#   - ui/manager/public/mockServiceWorker.js is MSW's generated dev worker; the Maven build
+#     excludes it from the jar.
+#   - ui/manager/scripts, e2e/, .ds-sync/ and .design-sync/ are CI and developer tooling.
+#   - Without `paths` the JavaScript extractor also reads YAML across the repository, so it
+#     graded backend files such as helm/eddi/values.yaml, which the java-kotlin analysis and
+#     the manifest tests already own.
+name: EDDI UI
+paths:
+  - ui/manager/src
+  - ui/chat/src

.github/dependabot.yml

@@ -93,6 +93,98 @@ updates:
     commit-message:
       prefix: "chore(docker)"
 
+  # The two frontends under ui/. They ran Renovate in their own repos (automerge
+  # of minor/patch once CI was green); the Renovate app is not installed on this
+  # repository, and two bots on one repo is the one clearly wrong option.
+  - package-ecosystem: npm
+    directory: /ui/manager
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - chore
+    # Let a release settle before proposing it; security updates are not delayed.
+    cooldown:
+      default-days: 3
+      semver-major-days: 14
+    groups:
+      # One PR for every open advisory instead of one per package.
+      security-updates:
+        applies-to: security-updates
+        patterns:
+          - "*"
+      minor-and-patch:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+    ignore:
+      # Carried over from the Manager's renovate.json: v8 folds react-router-dom
+      # into react-router, so an automated major breaks every import. Minor and
+      # patch bumps stay enabled — that is how a security fix arrives.
+      - dependency-name: "react-router*"
+        update-types: ["version-update:semver-major"]
+
+  - package-ecosystem: npm
+    directory: /ui/chat
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 3
+    labels:
+      - dependencies
+      - chore
+    # Let a release settle before proposing it; security updates are not delayed.
+    cooldown:
+      default-days: 3
+      semver-major-days: 14
+    groups:
+      # One PR for every open advisory instead of one per package.
+      security-updates:
+        applies-to: security-updates
+        patterns:
+          - "*"
+      minor-and-patch:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+    ignore:
+      # Same as the Manager: a react-router v8 major needs a manual migration.
+      - dependency-name: "react-router*"
+        update-types: ["version-update:semver-major"]
+
+  # The Manager's design-sync tooling (ui/manager/.ds-sync) is its own npm project with
+  # its own lockfile, and Dependency Review and Trivy scan it like any other: a stale
+  # advisory there fails every PR. Not shipped, so version updates are rare and small.
+  - package-ecosystem: npm
+    directory: /ui/manager/.ds-sync
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 2
+    labels:
+      - dependencies
+      - chore
+    cooldown:
+      default-days: 3
+      semver-major-days: 14
+    groups:
+      security-updates:
+        applies-to: security-updates
+        patterns:
+          - "*"
+      minor-and-patch:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+
   # GitHub Actions versions
   - package-ecosystem: github-actions
     directory: /