ci: add grouped Dependabot config + patch-only auto-merge workflow

[jliounis]

Summary

Burns down the current Dependabot alert backlog (6 high / 16 moderate / 1 low at the time of writing) without drowning maintainers in tiny one-dep-at-a-time PRs.

Adds two files:

.github/dependabot.yml

• Weekly npm + github-actions updates.
• Grouped PRs so we get a small number of weekly PRs instead of dozens:
  • production-dependencies: all non-major production minor+patch updates
  • development-dependencies: all non-major dev minor+patch updates
  • modelcontextprotocol: @modelcontextprotocol/* isolated so SDK churn doesn't get bundled with unrelated transitive upgrades
  • github-actions: all action bumps together
• Conventional-commit prefixes: deps, deps-dev, ci.
• Labels: dependencies, javascript / github-actions.

.github/workflows/dependabot-automerge.yml

• Auto-merges Dependabot PRs that are patch-only updates AND pass CI (via gh pr merge --auto, which waits for required status checks set by branch protection).
• Minor and major bumps explicitly stay open for human review and log why they were skipped.
• Uses dependabot/fetch-metadata@v2 to classify update-type.
• Permissions scoped to contents:write + pull-requests:write on the dependabot[bot] actor only.

What this PR intentionally does NOT do

• Does not bump @modelcontextprotocol/sdk or other deps directly. The audit found that bumping the SDK does not actually clear the current transitive alerts upstream, so a blind bump is churn without security gain. Let the new grouped Dependabot land the bumps that genuinely move the needle on its first weekly run.
• Does not enable required status checks on main. That needs repo-settings access and should be confirmed with maintainers before turning on (otherwise gh pr merge --auto falls back to immediate merge, which we do not want).

Pre-merge checklist for maintainers

1. Confirm branch protection on main requires the test job from .github/workflows/test.yml before merge — this is what makes gh pr merge --auto actually wait for CI.
2. Confirm Dependabot has access to the dependencies, javascript, and github-actions labels (auto-created on first use if missing).

Tests

Both YAML files validate against PyYAML's safe_load. No application code changes; npm test and npm run build unaffected.