Add Dependabot or Renovate for automated dependency updates

[AbelOsaretin]

What

No automated dependency update mechanism exists. Vulnerable transitive dependencies accumulate over time. The .github/ directory has no Dependabot or Renovate configuration.

Why

Manual dependency updates are infrequent and easily forgotten. Automated tools ensure security patches are applied promptly.

Scope

• Add dependabot.yml or renovate.json configuration
• Configure for npm/bun dependencies
• Set update schedule (weekly or daily)
• Group minor/patch updates to reduce PR noise

Acceptance Criteria

• Dependabot or Renovate configuration exists
• Monitors package.json dependencies
• Creates PRs for security updates automatically
• Groups minor/patch updates
• Respects bun.lock for reproducibility

Technical Context

• .github/ directory exists but no dependabot.yml
• package.json uses caret ranges for all deps
• bun.lock present for lockfile integrity