chore(ci): run Dependabot alongside Renovate for update coverage

[thewrz]

This was written agentically; verify its assertions and edit accordingly:

Why

Renovate has been this repo's only dependency-update tool, and every run was
suppressed by Mend's platform-level mode=silent — no PRs, no Dependency
Dashboard, nothing. That has now been switched off org-wide, but this repo was left
the most exposed of any in the org while it lasted: 39 open Dependabot
vulnerability alerts, 30 of them high severity, across three npm workspaces and a
uv-managed Python service.

This is also the repo the original Dependabot→Renovate migration was most meant to
protect — npm is exactly the ecosystem the migration cited as under supply-chain
attack.

What

Adds .github/dependabot.yml covering the full dependency surface, which nothing was
watching:

• npm — /bridge, /bridge-app, /dashboard
• uv — /server (pyproject.toml + uv.lock)
• docker — the /bridge, /dashboard, /server Dockerfiles
• github-actions — workflow pins

Group shapes and Conventional Commit prefixes mirror renovate.json so both tools'
output is directly comparable. Two behaviors are carried over deliberately:
@electron-forge/* gets its own group, and the DJ protocol libs
(alphatheta-connect, stagelinq) are excluded from grouped PRs so they keep
arriving individually for manual review.

Dependabot alerts and security updates were also enabled on the repo.

Running both tools at once is deliberate and temporary — it restores coverage now
and gives a side-by-side before we pick one. Expect duplicate PRs until then.

Heads up: with security updates enabled and 39 open alerts, merging this will produce
a burst of PRs. That is intended.

Testing

• Dependabot parses the config without errors (Insights → Dependency graph → Dependabot)
• Each of the six ecosystem entries resolves its manifest (no "no manifest found" errors)
• Security-update PRs open against the existing 39 alerts
• Protocol-lib bumps arrive as individual PRs, not folded into a group
• CI green

🤖 Co-authored by Claude Opus 5 (1M context).

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b72680a3-9018-42f1-80e6-18173ae97b15

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}