feat(ci): Renovate automated dependency updates (RECOMMENDATIONS #2)

Weekly Renovate run against this Gitea instance: grouped minor/patch PRs per
ecosystem, individually-reviewed majors (dashboard approval), immediate
security-alert PRs. All update PRs ride the existing required CI gates
(build/tests/gitleaks/vuln/live-db/format), so merging one is as safe as any
other PR.

ONE MANUAL STEP remains: create a Gitea PAT (repo rw, user r, issue rw, org r)
and add it as the RENOVATE_TOKEN Actions secret — the workflow fails fast with
instructions until then.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

renovate.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended"],
+  "timezone": "Europe/Berlin",
+  "schedule": ["before 6am on monday"],
+  "labels": ["dependencies"],
+  "prConcurrentLimit": 5,
+  "commitMessagePrefix": "chore(deps):",
+  "packageRules": [
+    {
+      "description": "Group safe minor+patch updates into one weekly PR per ecosystem",
+      "matchUpdateTypes": ["minor", "patch"],
+      "groupName": "{{manager}} minor & patch"
+    },
+    {
+      "description": "Major updates stay individual PRs for careful review",
+      "matchUpdateTypes": ["major"],
+      "dependencyDashboardApproval": true
+    }
+  ],
+  "vulnerabilityAlerts": {
+    "enabled": true,
+    "labels": ["security"],
+    "schedule": ["at any time"]
+  },
+  "ignorePaths": ["**/node_modules/**", "**/bin/**", "**/obj/**"]
+}