There was no Dependabot config, and its default PRs to main fail the promotion gate. Weekly grouped minor/patch updates for backend and frontend, monthly for GitHub Actions, all against dev.
