chore(hypatia): exempt frozen-archive placeholder DB password (false-positive)

Hypatia flags a CRITICAL js_hardcoded_secret in
playground/experiments/_attic/database-demos/arangodb-demo/queries.js
(`password: "rootpassword"`). That is a placeholder in the FROZEN demo
archive (_attic/, see FROZEN.md), not a real credential and not shipped
code, so it re-fires on every PR. Exempt it via .hypatia-ignore, matching
the existing per-file:rule convention.

Note: whether to keep the frozen _attic archive or delete it is a
checkpoint decision for the maintainer; this only silences the recurring
false-positive in the interim.

https://claude.ai/code/session_01BJmfoz1ZS1Pejy9LLMY742

Author: claude

.hypatia-ignore

@@ -11,3 +11,10 @@ vscode-extension/src/Extension.res:cicd_rules/banned_language_file
 web/Main.res:cicd_rules/banned_language_file
 web/MainTest.res:cicd_rules/banned_language_file
 web/Server.res:cicd_rules/banned_language_file
+
+# Frozen archive (playground/experiments/_attic/, see its FROZEN.md): retired
+# demo experiments kept for design lineage, not shipped code. The ArangoDB demo
+# uses a placeholder DB password ("rootpassword"), not a real credential — this
+# is a false-positive that re-fires on every scan. (Disposition keep-frozen vs
+# delete is a checkpoint decision; until then, exempt the false-positive.)
+playground/experiments/_attic/database-demos/arangodb-demo/queries.js:code_safety/js_hardcoded_secret