feat: implement smart Dependabot dependency grouping to reduce PR noise

[Copilot]

Problem

The current Dependabot configuration creates individual PRs for each dependency update, leading to significant noise and maintenance overhead. For a project with multiple package ecosystems (Python, npm, Docker, GitHub Actions), this could result in 20-30+ individual PRs monthly, making it difficult for maintainers to review and manage dependency updates effectively.

Solution

This PR implements a comprehensive smart grouping strategy for Dependabot that reduces PR noise while maintaining security and proper review processes:

🔧 Enhanced Coverage

• Added Python backend monitoring: Now tracks Poetry-managed dependencies in /backend
• Added root npm monitoring: Tracks dev tools like Prettier in root package.json
• Complete ecosystem coverage: GitHub Actions, Python (pip), npm (frontend + root), Docker

🏷️ Smart Grouping Strategy

Dependencies are now grouped by type and impact level:

Python Backend:

• python-runtime: Core dependencies (FastAPI, Neo4j, uvicorn) - minor/patch updates
• python-dev-tools: Development tools (black, pytest, flake8) - minor/patch updates
• python-major: All major updates (separate for careful review)

Frontend:

• frontend-runtime: React, MUI, routing libraries - minor/patch updates
• frontend-dev-tools: TypeScript, ESLint, Vite, testing tools - minor/patch updates
• frontend-major: All major updates (separate for careful review)

Infrastructure:

• github-actions: CI/CD workflow updates - minor/patch grouped
• docker-images: Base image updates - minor/patch grouped
• root-dev-tools: Configuration tools like Prettier - minor/patch grouped

📊 Expected Impact

Before: 20-30+ individual PRs monthly
After: ~6-10 grouped PRs monthly

• Reduced noise: Related dependencies updated together
• Easier reviews: Logical groupings make impact assessment simpler
• Risk management: Major updates kept separate for thorough evaluation
• Consistent process: All PRs follow conventional commit format with dependencies label

📚 Documentation

Added .github/dependabot-groups.md explaining the grouping strategy and rationale for future maintainers.

This approach balances staying current with dependencies while significantly reducing maintenance overhead and reviewer fatigue.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.