[P2][ci] Add Dependabot for GitHub Actions, Docker, and npm

[cevheri]

Summary

SHA-pinned GitHub Actions and Docker image digests have no automated update loop. Dependabot or Renovate should propose weekly bumps for actions, Docker base, and npm devDependencies.

Audit ID: Section 2 Med — Wave 2

Fix

Add .github/dependabot.yml:

version: 2
updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule: { interval: "weekly" }
  - package-ecosystem: "docker"
    directory: "/"
    schedule: { interval: "weekly" }
  - package-ecosystem: "npm"
    directory: "/"
    schedule: { interval: "weekly" }

Tune groups/ignore per maintainer preference; respect existing SHA-pin review discipline.

Acceptance criteria

• Dependabot config merged.
• First PRs appear or config validates in GitHub UI.
• No changeset.

Verification

GitHub → Insights → Dependency graph → Dependabot.

[cevheri]

Implemented and shipped in PR #43 (merge commit 69f7161), released as v0.2.0. The PR description's comma-separated Closes list only auto-closed the first reference — closing manually. For #39/#28-style partials: the shipped scope is done; the real-browser verification half of #39 continues under #10, and the typed-error contract (#28) shipped as LibreDbError with stable codes across kernel, adapters, lenses, and CLI.