ci(renovate): pre-merge CI for renovate PRs + group FE toolchain

ci.yml: add pull_request trigger (base dev) so renovate/* PRs get validated before merge; dev→main flow unchanged (base main), no duplicate runs. renovate.json: group vite/vitest/plugin-vue/happy-dom/@vue-test-utils into one PR (version-coupled).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.forgejo/workflows/ci.yml

@@ -9,10 +9,15 @@ name: CI
 on:
   push:
     branches: [dev, main]
-  # pull_request trigger intentionally absent — with branches: [dev, main]
-  # above, every PR commit already fires CI via the push event on dev. Adding
-  # pull_request would duplicate runs on dev→main PRs. FC has no fork PRs
-  # (single-operator Forgejo repo) so push coverage is complete.
+  # Renovate opens PRs from `renovate/*` branches into `dev`. Those branches
+  # never push to dev/main, so the push trigger above gives them NO pre-merge
+  # CI — a bump could only be validated after it was already merged. This
+  # pull_request trigger (base `dev` only) validates Renovate PRs before merge.
+  # It deliberately does NOT fire on dev→main PRs (base `main`), which still
+  # rely on the dev push run — so no duplicate runs. FC has no fork PRs
+  # (single-operator Forgejo repo), so secrets-on-PR is not a concern.
+  pull_request:
+    branches: [dev]
 
 jobs:
   # Fast-fail lint lane. ruff is pre-installed in the ci-python image, so