chore: add Renovate configuration

Set up Renovate (Mend) GitHub App integration with:
- Recommended base config plus Docker/Action digest pinning
- Dependency Dashboard enabled
- Minor/patch updates grouped per dependency
- Major updates in separate PRs
- Semantic commit prefixes (fix for deps)
- Automerge strategy: squash
- npm supply-chain protection (3-day release age)

renovate.json

@@ -0,0 +1,25 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended",
+    "docker:pinDigests",
+    "helpers:pinGitHubActionDigests",
+    ":configMigration",
+    ":pinDevDependencies",
+    "abandonments:recommended",
+    "security:minimumReleaseAgeNpm",
+    ":dependencyDashboard"
+  ],
+  "automergeStrategy": "squash",
+  "packageRules": [
+    {
+      "matchUpdateTypes": ["minor", "patch"],
+      "groupName": "{{depName}}",
+      "commitMessagePrefix": "fix(deps)"
+    },
+    {
+      "matchUpdateTypes": ["major"],
+      "groupName": "major-{{depName}}"
+    }
+  ]
+}