chore: add Dependabot for npm and GitHub Actions

[Amayyas]

Adds .github/dependabot.yml covering both ecosystems the repo uses: npm (package-lock.json) and GitHub Actions (the CI workflow).

Choices, fitted to this project

• Majors are ignored. The stack is pinned for Node 18 (React Router 6, Vite 5, Tailwind 3…); a major bump would break CI. Those stay manual, tied to when the Node baseline moves.
• Minor + patch are grouped into a single weekly PR per ecosystem, so the five required checks vet a batch together instead of one noisy PR at a time — this is exactly the setup where auto-updates are safe to merge.
• Conventional Commits: npm updates land as chore(deps): …, Actions as ci(deps): …, matching the history.
• Weekly on Monday, dependencies label, 5 open-PR cap.

Security alerts (Dependabot's other half) are enabled separately in Settings → Code security; this file governs version updates.

Summary by CodeRabbit

• Chores
  • Enabled Dependabot v2 with two weekly Monday update streams for npm dependencies and GitHub Actions.
  • Applied consistent labels to generated pull requests and standardized commit message prefixes.
  • Consolidated minor/patch npm updates into a single PR and grouped related GitHub Actions updates.
  • Automatically skipped semver-major updates for both npm packages and GitHub Actions.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: f2fc4c04-cf9b-418b-9cba-f5ac2fc0adae

📥 Commits

Reviewing files that changed from the base of the PR and between d013e60 and 5948c54.

📒 Files selected for processing (1)

• .github/dependabot.yml

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/dependabot.yml

---

📝 Walkthrough

Walkthrough

Adds Dependabot v2 configuration for weekly npm and GitHub Actions updates, including grouping, labels, commit-message formatting, an npm pull request limit, and ignored major versions.

Changes

Dependabot updates

Layer / File(s)	Summary
Dependabot update policies .github/dependabot.yml	Configures Monday npm and GitHub Actions updates, groups updates, applies labels, formats commit messages, limits npm open pull requests to 5, and ignores semver-major updates for both ecosystems.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: adding Dependabot configuration for npm and GitHub Actions.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/dependabot

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/dependabot.yml:
- Around line 48-51: Update the github-actions group in dependabot.yml so major
GitHub Actions updates are excluded while minor and patch updates remain
enabled; scope the existing major-update policy to npm only if necessary,
without changing the npm behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 40699fb6-a49e-4436-a309-3a9f7b1c3cc4

📥 Commits

Reviewing files that changed from the base of the PR and between a22d956 and d013e60.

📒 Files selected for processing (1)

• .github/dependabot.yml