fix(security): regex-audit missing inline-literal detection for .ts/.tsx/.jsx/.mjs/.cjs

Only .js had the 'regex_literal_inline' pattern (bare /pattern/flags used
directly as a call argument, e.g. .replace(/[-:T]/g, '')). Every other JS
family extension — .mjs, .cjs, .ts, .tsx, .jsx — was missing it, so any
inline (non-variable-assigned) regex literal in TypeScript/JSX went
completely undetected.

Found via real-codebase validation (Coretax-Auto-Downloader KDS backend,
all .ts): regex-audit reported total_patterns:0 despite genuine inline
regex literals (.replace(/[-:T]/g, ''), .replace(/\s+/g, '.')) confirmed
present via grep.

Fix: add the same inline-literal pattern already used for .js to the
other 4 extensions. Verified: total_patterns went from 0 to 1735,
vulnerable stayed 0 (no ReDoS-prone patterns in this codebase) — the
inline pattern is inherently noisy for raw counting (same tradeoff .js
already accepted), but doesn't affect the vulnerability-flagging logic.

Author: Wolfvin

scripts/regexaudit_engine.py

@@ -79,25 +79,37 @@
         (r'new\s+RegExp\s*\(\s*("([^"]*)"|\'([^\']*)\')', "regexp_constructor"),
         (r'/([^/\n]+)/[gimsuy]*', "regex_literal_inline"),
     ],
+    # Bug fix: only .js had "regex_literal_inline" (bare /pattern/flags used
+    # directly as a call argument, e.g. `.replace(/[-:T]/g, '')`) — .mjs/.cjs/
+    # .ts/.tsx/.jsx were missing it, so any inline (non-variable-assigned)
+    # regex literal in TypeScript/JSX went completely undetected. Found via
+    # real-codebase validation (Coretax-Auto-Downloader KDS backend, all .ts):
+    # regex-audit reported total_patterns:0 despite genuine inline regex
+    # literals like `.replace(/[-:T]/g, '')` and `.replace(/\s+/g, '.')`.
     ".mjs": [
         (r'(?:const|let|var)\s+\w+\s*=\s*(/[^/\n]+/[gimsuy]*)', "regex_literal"),
         (r'new\s+RegExp\s*\(\s*("([^"]*)"|\'([^\']*)\')', "regexp_constructor"),
+        (r'/([^/\n]+)/[gimsuy]*', "regex_literal_inline"),
     ],
     ".cjs": [
         (r'(?:const|let|var)\s+\w+\s*=\s*(/[^/\n]+/[gimsuy]*)', "regex_literal"),
         (r'new\s+RegExp\s*\(\s*("([^"]*)"|\'([^\']*)\')', "regexp_constructor"),
+        (r'/([^/\n]+)/[gimsuy]*', "regex_literal_inline"),
     ],
     ".ts": [
         (r'(?:const|let|var)\s+\w+\s*(?::\s*\w+(?:<[^>]+>)?)?\s*=\s*(/[^/\n]+/[gimsuy]*)', "regex_literal"),
         (r'new\s+RegExp\s*\(\s*("([^"]*)"|\'([^\']*)\')', "regexp_constructor"),
+        (r'/([^/\n]+)/[gimsuy]*', "regex_literal_inline"),
     ],
     ".tsx": [
         (r'(?:const|let|var)\s+\w+\s*(?::\s*\w+(?:<[^>]+>)?)?\s*=\s*(/[^/\n]+/[gimsuy]*)', "regex_literal"),
         (r'new\s+RegExp\s*\(\s*("([^"]*)"|\'([^\']*)\')', "regexp_constructor"),
+        (r'/([^/\n]+)/[gimsuy]*', "regex_literal_inline"),
     ],
     ".jsx": [
         (r'(?:const|let|var)\s+\w+\s*=\s*(/[^/\n]+/[gimsuy]*)', "regex_literal"),
         (r'new\s+RegExp\s*\(\s*("([^"]*)"|\'([^\']*)\')', "regexp_constructor"),
+        (r'/([^/\n]+)/[gimsuy]*', "regex_literal_inline"),
     ],
     ".py": [
         (r're\.compile\s*\(\s*(?:r)?["\']([^"\']+)["\']', "re_compile"),