ci: Dependabot for app npm, pipeline npm+pip, actions — weekly, grouped, pins guarded (#13)

[DocGerd]

Closes #13

Summary

Enables Dependabot for automated dependency updates across npm (app + pipeline), pip (pipeline), and GitHub Actions ecosystems, with weekly grouped minor+patch updates to keep PR noise low under the serial-merge policy.

Pin guards

To avoid bot-driven chaos:

• TypeScript: Deliberate exact pin — TS minors routinely break strict builds; bumped manually only
• Test infra majors (fast-check, vitest, @vitest/*, @playwright/test): Reshape the seeded fast-check property suite and test infrastructure — manual review only
• Runtime stack majors (react, react-dom, workbox-*): Exact-pinned; majors are deliberate migrations, not bot PRs

Note

pip bumps stay effectively unverified by CI until #14's mask job lands (next PR).