Re-enable Dependabot security-only

[YaronZaki]

• Difficulty: good-first-issue · Effort: XS · Impact: every library in pyproject.toml + frontend/package.json

• Problem Statement
  .github/dependabot.yml:

  # Dependabot disabled per team decision: weekly Dependabot PRs were noisy
  enabled: false
  updates: ...

  This means GHSA advisories against fastapi 0.115.0, aiohttp,
  jinja2 3.1.4, sqlalchemy 2.0.51 (all imported today) will not surface
  on the PR queue. The Cinderblock team acknowledged this is incorrect
  for security signals specifically.

• Expected Outcome
  enabled: true with security_updates_only: true for pip/npm; weekly
  schedule; auto-merge from dependabot[bot] after CI passes.

• Acceptance Criteria

  • PR from a CVE-tested package reproduces the workflow firing.
  • release.yml allows auto-merge on dependabot PRs (signing key preserved).
  • security_updates_only: true set for both ecosystems.
  • Existing tests still pass; weekly PR noise limited (auto-merge on CI green).

• Implementation Notes
  Add groups: for security-only updates and a single package-rules
  entry that maps them to auto-merge.

• Files / Modules Affected

  • .github/dependabot.yml
  • .github/workflows/release.yml (auto-merge permission)

• Dependencies: tied to #86 SECURITY.md disclosure policy.

[GBOYEE]

Hey! .github/dependabot.yml has enabled: false, so advisories against fastapi/aiohttp/jinja2/sqlalchemy never surface. I'd flip it to security-only updates (scoped to those ecosystems) so GHSA alerts start flowing again without the weekly noise. Quick config change — mind if I take it?

[kevinnft]

Opened PR re-enabling Dependabot with security-update grouping:

#359