Keep vendored code out of the SonarCloud analysis (#186)

## Why

`storytold_artcraft-services` has **197,233** open findings, and
**194,232 of them (98%) are inside
`crates/vendor/candle/candle-flash-attn/cutlass/`** — generated Doxygen
HTML plus a copied Python tree that ships inside the vendored
`candle-flash-attn` crate. None of it is our code, and every vendor bump
brings the findings back, so clearing them by hand is wasted work. They
also bury the 3,001 findings that are actually ours.

The project is analysed by SonarCloud's GitHub App (**automatic
analysis**): there is no `sonar-project.properties` and no scanner step
in CI. In that mode SonarCloud reads `.sonarcloud.properties` from the
default branch — and ignores scope configured in its UI — so this file
is how the scope gets pinned in the repository.

## What

`.sonarcloud.properties`:

- `sonar.exclusions=crates/vendor/**` — the vendored tree stops
producing issues.
- `sonar.cpd.exclusions=crates/vendor/**` — the same tree out of
copy-paste detection, which is where most of the project's 32%
duplicated lines come from.

No source changes: the file only narrows the analysis scope.

## After merge

The next automatic analysis on `main` should report roughly 3,000
findings instead of 197,233, and `Web:S1827` / `Web:S6827` — 159k of
them between them — should be gone. Check with:

```bash
curl -s 'https://sonarcloud.io/api/issues/search?componentKeys=storytold_artcraft-services&resolved=false&ps=1&facets=types,rules'
```

The analysis of this PR itself will still count the vendored files: a
`.sonarcloud.properties` file only takes effect once it is on the
default branch.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

<!-- coderabbit-ai-generated:v1 -->

## Summary by CodeRabbit

* **Chores**
* Updated internal quality-analysis settings to exclude vendored code
from automated analysis and copy-paste checks. This change affects
project maintenance workflows only and does not alter application
behavior, user-facing features, or the way users interact with the
product. No other end-user-visible changes are included in this release.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

.sonarcloud.properties

@@ -0,0 +1,17 @@
+# SonarCloud automatic analysis (the "SonarCloud Code Analysis" GitHub App
+# check) reads this file from the default branch. The repo has no
+# sonar-project.properties, and while automatic analysis is on SonarCloud
+# ignores both that file and the scope set in its UI, so the scope lives here.
+#
+# Docs: https://docs.sonarsource.com/sonarqube-cloud/analyzing-source-code/automatic-analysis
+#
+# Vendored third-party code is not ours and is not worth analysing:
+# crates/vendor/candle/candle-flash-attn/cutlass/ ships generated Doxygen HTML
+# and a copied Python tree, which accounted for 194,232 of this project's
+# 197,233 open findings. They come back whenever the vendor copy is bumped, so
+# fixing them by hand is wasted work, and they drown the real findings.
+sonar.exclusions=crates/vendor/**
+
+# Same scope for copy-paste detection: the vendored HTML/Python is most of the
+# duplicated lines, so it should not count against this project either.
+sonar.cpd.exclusions=crates/vendor/**