chore: consolidate Dependabot update workflow

[codethor0]

Summary

Reduce Dependabot branch proliferation after twelve concurrent PRs accumulated post-v0.1.1.

Problem

Dependabot opened separate PRs for each ecosystem bump because:

• GitHub Actions had no grouping configured
• open-pull-requests-limit allowed up to five pip/npm PRs simultaneously
• Major upgrades were not separated from routine minor/patch work

Changes

• Reduce pip and frontend npm limits from 5 to 2 open PRs
• Reduce extension npm limit from 3 to 2
• Reduce github-actions limit from 3 to 1
• Add a github-actions group so workflow action bumps arrive in one PR

Steady-state target

• One grouped Python minor/patch PR (when updates exist)
• One grouped frontend minor/patch PR (when updates exist)
• One grouped GitHub Actions PR (when updates exist)
• Major upgrades handled via tracking issues Backend major dependency upgrades (bcrypt, redis, mypy) #33 and Frontend major framework and toolchain upgrades (React, TypeScript, Tailwind, Jest) #34

Security

Dependabot security updates remain enabled (default). This configuration does not disable security alerts or security PRs.

Related cleanup

• Closed superseded Actions PRs chore(deps): bump actions/setup-python from 5 to 6 #18, chore(deps): bump actions/setup-node from 4 to 6 #19, chore(deps): bump actions/checkout from 4 to 7 #20 in favor of chore: consolidate GitHub Actions workflow updates #32
• Closed deferred major PRs chore(deps): bump bcrypt from 4.2.1 to 5.0.0 in /backend #23 through chore(deps-dev): bump jest and @types/jest in /frontend #29 with tracking issues
• Open routine update PRs chore(deps): bump the python-minor-patch group across 1 directory with 14 updates #21 and chore(deps): bump the frontend-minor-patch group across 1 directory with 8 updates #22 remain for normal review

Test plan

• YAML is valid
• Maintainer review and merge through protected branch process