ci: automate dependency updates and coverage gates

[jarvisimus]

Summary

• configure Dependabot to group npm, Docker, and GitHub Actions patch/minor updates while leaving majors for manual review
• add a least-privilege pull_request_target workflow that enables native squash auto-merge only for unmodified Dependabot patch/minor PRs after required checks pass
• enforce Node's built-in source-only coverage gates in CI and document the local verification workflow
• add integration and edge-case tests for routing/authentication, request parsing, config, chat translation, upstream responses, and token refresh behavior

Results

• tests: 20 → 54
• line coverage: 72.52% → 84.23%
• branch coverage: 67.33% → 93.97%
• function coverage: 83.33% → 86.11%
• coverage gates: 84% lines / 90% branches / 85% functions

Test plan

• npm run test:coverage
• npm run typecheck
• npm audit --audit-level=moderate
• Node 22.23.1 coverage run with source-only include
• actionlint 1.7.12

Safety notes

The auto-merge workflow never checks out or executes pull-request code. Its metadata job is read-only, the write-capable job is head-SHA-bound, and maintainer-modified Dependabot PRs have auto-merge revoked. Major dependency updates remain manual, and native auto-merge waits for the repository's required status checks before merging.