Stabilize dependency maintenance and CI

[itsevin]

Summary / 概要

• consolidate all current Dependabot updates into one tested maintenance change
• upgrade GitHub Actions to current Node.js runtimes
• group future routine dependency updates to reduce PR noise
• replace documentation password placeholders that caused Gitleaks false positives
• migrate NoneBot CLI metadata to its current grouped format

整合现有 Dependabot 更新，升级 GitHub Actions 运行时，减少后续零散 PR，并修复 Gitleaks 文档示例误报与 NoneBot 旧格式警告。

Verification / 验证

• poetry check --lock
• poetry run python -m pip check
• poetry run pytest -q — 12 passed
• poetry run ruff check src scripts tests
• poetry run python scripts/check_open_source.py
• poetry run python scripts/init_database.py
• npm ci
• npm run build
• npm audit --audit-level=high — 0 vulnerabilities
• desktop and 390×844 browser regression: login, JWT session, dashboard, logout, protected-route redirect; no console errors

Notes / 说明

The known ECharts production chunk-size warning remains a performance optimization opportunity; it does not affect correctness or this release.