chore(ci): extend dependabot to docs/ npm and Docker, group minor/patch bumps

.github/dependabot.yml

@@ -1,11 +1,61 @@
 version: 2
 updates:
+  # Rust crates. Minor and patch bumps arrive as one grouped PR per month;
+  # major bumps stay separate because they need a real review, and queue
+  # behind it (one open version-update PR per ecosystem at a time).
+  - package-ecosystem: "cargo"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    open-pull-requests-limit: 1
+    commit-message:
+      prefix: "chore(deps)"
+    groups:
+      cargo-minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+
+  # GitHub Actions used by ci.yml, docs.yml and release.yml.
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "weekly"
+      interval: "monthly"
+    open-pull-requests-limit: 1
+    commit-message:
+      prefix: "chore(ci)"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
 
-  - package-ecosystem: "cargo"
+  # Astro Starlight documentation site (pnpm workspace in docs/).
+  - package-ecosystem: "npm"
+    directory: "/docs"
+    schedule:
+      interval: "monthly"
+    open-pull-requests-limit: 1
+    commit-message:
+      prefix: "chore(docs)"
+    groups:
+      docs-minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+
+  # Base images of the two Dockerfile stages (rust:1-bookworm,
+  # debian:bookworm-slim).
+  - package-ecosystem: "docker"
     directory: "/"
     schedule:
-      interval: "weekly"
+      interval: "monthly"
+    open-pull-requests-limit: 1
+    commit-message:
+      prefix: "chore(docker)"