chore(ci): run Dependabot monthly with grouped minor/patch updates (#52)

[vianbas]

Summary

Reduces how many version-update PRs Dependabot opens without weakening security updates.

Closes #52

• Schedule: weekly → monthly for Go, npm and GitHub Actions.
• Grouping: all minor and patch version updates arrive as one PR per ecosystem (go-minor-patch, npm-minor-patch, actions-minor-patch). Major updates keep their own PR. This also keeps the CodeQL init, autobuild and analyze bumps together; today they arrive split (chore(ci): bump github/codeql-action/autobuild from 3.36.2 to 4.36.2 #35–chore(ci): bump github/codeql-action/analyze from 3.36.2 to 4.36.2 #37) and each one fails CI alone.
• Cooldown: a release has to be 7 days old before Dependabot proposes it, and 30 days for majors in Go and npm. GitHub Actions doesn't support per-semver cooldown keys, so Actions uses 7 days for every update.
• Labels: dependencies, javascript, go and github-actions now exist in the repo, created alongside this PR. This stops the "labels could not be found" comments on Dependabot PRs.

Architecture summary

Only .github/dependabot.yml changes. There is no application code, CI workflow or Docker change.

Security considerations

Security updates are unaffected. According to the Dependabot options reference:

• update-types only affects version updates, not security updates.
• The cooldown does not apply to security updates.

Dependabot security updates are enabled for the repo, so security PRs still open as soon as an advisory is known. The cooldown also lowers the risk of picking up a broken or malicious release in its first days.

Testing evidence

• Validated against the SchemaStore Dependabot v2 schema: 0 errors. Two negative controls (an invalid interval, and a non-numeric cooldown) were rejected, which shows the validator actually checks these fields.
• git diff --check is clean.
• Dependabot only reads this file from the default branch, so the real check is the first run after merge.

Known limitations

• The effect only shows after merge, at the next monthly run.
• Grouped PRs are expected to replace the currently open individual version-update PRs. Any that remain will be closed by hand.
• Dependabot has no notion of "LTS". The Docker base images (node:24, golang:1.26, postgres:16) aren't managed by Dependabot and stay pinned to the versions chosen in the Dockerfiles and Compose file.

Follow-up issues

• After the first run: confirm there's no configuration error, check that grouped PRs appeared, and close any leftover individual PRs.

Checklist

• Branch is not main; this PR targets main.
• Conventional commit message.
• Config validated against the Dependabot schema.
• git diff --check is clean.
• No secrets, real/personal data, or proprietary references.
• Contracts updated first where applicable (OpenAPI/AsyncAPI): n/a.
• Docs updated to match the change: n/a, no doc describes the Dependabot schedule.