ci(deps): automate dependency maintenance

[RyleaStark]

Stack

• chore(deps): refresh frontend dependencies #1 — frontend dependency and npm security refresh
• PR chore(deps): refresh backend dependencies #2 — backend runtime dependency refresh
• This PR — dependency automation and CI hardening
• PR #4 — pre-release minor-version audit and any required application changes
• PR chore: harden minor release readiness #5 — version bump and GHCR/Docker Hub publication

Merge after PR #2.

Summary

• enables weekly Dependabot coverage for npm, pip, GitHub Actions, and Docker
• groups minor and patch updates while leaving major updates independently reviewable
• adds blocking npm audit and pip-audit security gates to CI
• pins CI to Python 3.11.15 and Node 22.23.1
• updates pytest to 9.0.3 to remove its current advisory
• pins Docker build/runtime stages to matching explicit Python and Node patch releases
• updates every GitHub Action to its current upstream release and pins it to the immutable release commit SHA
• disables persisted checkout credentials in every job
• pins pip-audit as a reproducible development/CI dependency

Verification

• clean Python 3.11.15 dependency installation
• pip check
• Ruff
• pytest — 92 passed
• pip-audit — no known vulnerabilities
• clean npm ci under Node 22.23.1
• npm audit — 0 vulnerabilities
• ESLint
• Vitest — 32 passed
• production Vite build
• confirmed python:3.11.15-slim and node:22.23.1-slim manifests exist

Next layers

PR #4 will be an evidence-driven pre-release audit. It will review and, where warranted, implement:

• FastAPI/Starlette compatibility and the remaining deprecation warnings
• OpenAPI and externally visible behavior changes from the dependency stack
• LND/gRPC, Nostr WebSocket, webhook, and container runtime smoke coverage
• documented Python/Node minimums and installation instructions
• the current large frontend bundle warning and whether code splitting is appropriate
• Docker runtime hardening, health checks, SBOM/provenance settings, multi-architecture output, and registry configuration
• release notes and any migration guidance needed for a minor release

PR #5 will contain the actual VERSION bump and resulting GHCR/Docker Hub publication after the audit layer is green.