chore(deps): fix stale Dependabot config + fold in safe dep bumps (go-git, react-router)

[dvcdsys]

Cleanup pass over the open Dependabot PRs (you asked for a review of all 6). This consolidates the safe changes into one branch off develop and fixes the root cause that was generating the dead PRs.

The root problem

.github/dependabot.yml still described the pre-migration layout:

• scanned pip /api, pip / (root pyproject.toml), docker /api — all gone since the Python→Go migration → produced dead PRs against deleted files (build(deps): bump cryptography from 46.0.5 to 46.0.6 in the uv group across 1 directory #20 root uv.lock, chore(deps): bump the uv group across 1 directory with 2 updates #22 legacy/python-api/uv.lock).
• did not list /server (gomod) or /server/dashboard (npm) at all — those updates only showed up via repo-wide security updates (which ignore the config).

What's in this PR

Change	Source PR	Notes
Rewrite dependabot.yml for real structure	—	gomod /server, gomod /cli, npm /server/dashboard, docker /server, github-actions /. Python (archived) intentionally not scanned. Light per-ecosystem grouping to cut noise.
go-git/v5 5.19.0 → 5.19.1	#55	clean patch, used by repo-clone path
react-router 6.30.3 → 6.30.4 (lockfile)	#69 (safe half)	within existing ^6.28.0

Deliberately deferred

vite 5.4.21 → 8.0.16 (#69/#70) — a 3-major jump driven by the esbuild advisory GHSA-67mh-4wv8-2f99, which only affects the dev server. We never run vite dev in prod (the dashboard is built to static assets and embedded), so there's no real exposure. The major upgrade deserves its own PR with build testing, not a blind merge.

Testing

• go build ./... + go test ./... (server) — all green
• npm run build (dashboard) — builds clean on vite 5 with react-router 6.30.4
• dependabot.yml validated as YAML (5 ecosystems parse correctly)

Follow-up once this merges (to confirm)

• Merge-superseded → close: chore(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 in /server in the go_modules group across 1 directory #55 (go-git, folded here), build(deps): bump the npm_and_yarn group across 1 directory with 2 updates #69/build(deps): bump esbuild and vite in /server/dashboard #70 (vite deferred; react-router folded here)
• Dead → close: build(deps): bump cryptography from 46.0.5 to 46.0.6 in the uv group across 1 directory #20, chore(deps): bump the uv group across 1 directory with 2 updates #22 (target deleted Python files), chore(deps): bump esbuild and vite in /server/dashboard #37 (stale esbuild/vite, superseded)
• Open a dedicated vite 5 → 8 upgrade PR if/when we want it.

Note for review

The docker /server ecosystem entry is new — it tracks base-image CVEs in Dockerfile/Dockerfile.cuda, aligned with the Scout workflow. If you'd rather keep base-image pinning fully manual, say so and I'll drop it.

🤖 Generated with Claude Code