(chore): Add dependabot #185

Add .github/dependabot.yml covering:

• uv for uv.lock
• npm for ui/
• github-actions
• docker for the base images

Group patch and minor bumps so it does not open 20 PRs a week. Now that #184 makes CI install all extras and gate the lock, bump PRs actually get validated.

Two gaps it will not close:

• Debian packages in the image, which were most of the unresolved findings in chore(security): target dependency lock for CVE fixes #182. Needs a
  scheduled trivy or grype scan, separate issue.
• Dockerfile:19 pulls ghcr.io/astral-sh/uv:latest, so nothing can track it. Worth pinning to a
  digest while we are here.

• add dependabot.yml
• confirm dependabot's uv support reads our lock, fall back to renovate if not
• pin the uv image