chore: dependency maintenance and Dependabot config (1.0.1)

[arengia]

Closes the dependency backlog that had built up since the initial public release, and sets things up so it does not build up again.

What this does

34 of 36 open Dependabot advisories are cleared by an in-range npm update. No package.json range was widened, so nothing here is a breaking upgrade:

package	from	to	advisories
hono	4.12.9	4.12.33	23 (1 high)
basic-ftp	5.2.0	5.3.1	4 (all high)
ws	8.20.0	8.21.1	2 (1 high)
js-yaml	4.1.1	4.3.1	2 (1 high)
@hono/node-server	1.19.11	1.19.17	1
ip-address	10.1.0	10.4.0	1
esbuild	0.27.4	0.28.1	1

One code change was required. The update carries Puppeteer from 24.40.0 to 24.43.1, which removed the networkidle values from the waitUntil union of setContent. src/services/pdf.ts now waits for 'load'. That is safe here: all three templates in src/views/pdf-*.ts render a self-contained HTML string with inline styles and no external images, stylesheets or fonts, so there is no network activity to idle on. Without this change the build fails on a type error.

.github/dependabot.yml is new. Security alerts were already enabled, but nothing was opening pull requests, which is why the advisories sat untouched. Minor and patch updates are now grouped into one PR per ecosystem per month. Security updates ignore that schedule and arrive immediately.

What is deliberately left open

Two @hono/node-server advisories below 2.0.5, both describing a path traversal in serve-static that requires a Windows host. serveStatic is genuinely used (src/app.ts:33), but Crewfest is deployed as a Linux container, and closing these means a major upgrade to 2.x. That belongs in its own PR with its own testing.

For the record on the highs that are now closed: the hono CORS advisory never applied, because no CORS middleware is used anywhere in the codebase. The basic-ftp, ws and js-yaml advisories are all transitive under Puppeteer and would need a hostile FTP proxy or WebSocket peer to trigger. They were noise, but 36 red alerts on a public repository are their own kind of problem.

Verification

Locally: npm run build and npx tsc --noEmit both pass, npm audit reports only the deferred advisory above. CI covers the rest, including a real PDF export through Puppeteer, which is the part this PR actually touches.

🤖 Generated with Claude Code