Configure Dependabot for automated dependency updates

.github/dependabot.yml

@@ -0,0 +1,41 @@
+# Version updates run monthly, grouped so each ecosystem opens at most two pull
+# requests a run: one for every minor and patch bump, one for every major. Majors
+# are kept apart because they are the ones that need reading before merging.
+#
+# Security updates are switched on in the repository settings, not here, and open
+# as soon as an advisory lands whatever the schedule. The security-updates groups
+# only batch them along the same minor/patch vs major line.
+#
+# Dependabot installs without lifecycle scripts, so npm PRs arrive with the
+# lockfile unshaken and verify.yaml fails them. Run `npm install` on the branch
+# and commit package-lock.json (DEVELOPMENT.md, "Lockfile dev flags").
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: monthly
+    groups:
+      npm-minor-patch:
+        update-types: [minor, patch]
+      npm-major:
+        update-types: [major]
+      npm-security-minor-patch:
+        applies-to: security-updates
+        update-types: [minor, patch]
+      npm-security-major:
+        applies-to: security-updates
+        update-types: [major]
+
+  # `/` covers .github/workflows; composite actions are found by their own directory.
+  - package-ecosystem: github-actions
+    directories:
+      - /
+      - /.github/actions/*
+    schedule:
+      interval: monthly
+    groups:
+      actions-minor-patch:
+        update-types: [minor, patch]
+      actions-major:
+        update-types: [major]

ARCHITECTURE.md

@@ -1234,7 +1234,6 @@ npm install parent-package@latest          # Update parent if needed
 3. **Accessibility** — More ARIA labels and keyboard navigation
 4. **Documentation** — Inline code comments for complex logic
 5. **Caching** — Service Worker for offline support
-6. **Dependencies** — Automated dependency update checks (Dependabot)
 
 ## Glossary
 

DEVELOPMENT.md

@@ -662,6 +662,12 @@ Pinned packages:
 
 `react`, `react-dom`, and `typescript` currently use `^` ranges rather than exact pins. Unpinned packages allow patch and minor updates for utilities and non-critical dependencies.
 
+#### Automated Updates
+
+Dependabot (`.github/dependabot.yml`) checks npm packages and GitHub Actions on the first of each month. Each run opens at most two pull requests per ecosystem: one for all minor and patch bumps, one for all majors. Pinned packages are bumped like any other, so a `next` patch rides in the minor/patch PR.
+
+Security updates are enabled in the repository settings and open as soon as an advisory is published, whatever the schedule; they are grouped along the same minor/patch vs major line. An npm PR from either needs its lockfile re-shaken before `verify.yaml` will pass (see [Lockfile dev flags](#lockfile-dev-flags)).
+
 #### Security Audits
 
 There is no automated `npm audit` gate in CI today — `verify.yaml` runs lint, typecheck, test, and (on PRs) a fixture build; `deploy.yaml` verifies, builds and deploys. Run audits locally (and before merging dependency changes):