ci: configure Dependabot for Bun + GitHub Actions, drop package-lock.json

.github/dependabot.yml

@@ -0,0 +1,33 @@
+# Dependabot version updates.
+# Docs: https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+version: 2
+
+updates:
+  # JavaScript dependencies — managed with Bun (bun.lock is the source of truth;
+  # the deploy/CI workflows run `bun install`). Requires Bun >= 1.1.39.
+  - package-ecosystem: "bun"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "chore(deps)"
+    groups:
+      # Batch all non-major updates into a single PR to cut review noise.
+      # Major bumps still arrive as individual PRs (they need manual review).
+      minor-and-patch:
+        update-types:
+          - "minor"
+          - "patch"
+
+  # GitHub Actions — keeps the SHA pins (and their `# vX.Y.Z` comments) current.
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "ci"
+    groups:
+      actions:
+        patterns:
+          - "*"