chore: tune Renovate config (group, throttle, automerge minor/patch, hold majors)

- Target dev (deps flow through the dev->main batch; automerge works on the
  unprotected branch) instead of opening PRs straight against protected main.
- Ignore flutter_client/** -- the Flutter client is retired/legacy; drop the
  ~9 Flutter dep PRs and keep Android-native + server + web updates.
- Auto-merge GREEN patch/minor/digest/pin bumps; hold ALL majors behind
  dependency-dashboard approval (labelled deps:major) for manual review.
- Group Go modules, CI actions, Docker images, Android Gradle, and web npm
  non-major bumps into single PRs to cut noise.
- Throttle: weekend schedule, prHourlyLimit 2; monthly lockfile maintenance.

renovate.json

@@ -1,6 +1,61 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "config:recommended"
+    "config:recommended",
+    ":semanticCommits"
+  ],
+  "baseBranches": ["dev"],
+  "timezone": "America/New_York",
+  "schedule": ["every weekend"],
+  "prHourlyLimit": 2,
+  "prConcurrentLimit": 8,
+  "ignorePaths": [
+    "**/node_modules/**",
+    "**/vendor/**",
+    "flutter_client/**"
+  ],
+  "lockFileMaintenance": {
+    "enabled": true,
+    "schedule": ["before 5am on the first day of the month"]
+  },
+  "packageRules": [
+    {
+      "description": "Auto-merge patch/minor/digest/pin bumps once CI is green",
+      "matchUpdateTypes": ["minor", "patch", "digest", "pin"],
+      "automerge": true
+    },
+    {
+      "description": "Hold all major bumps for manual approval via the dependency dashboard",
+      "matchUpdateTypes": ["major"],
+      "automerge": false,
+      "dependencyDashboardApproval": true,
+      "addLabels": ["deps", "deps:major"]
+    },
+    {
+      "description": "Group Go module updates into one PR",
+      "matchManagers": ["gomod"],
+      "groupName": "go modules"
+    },
+    {
+      "description": "Group CI workflow action bumps",
+      "matchManagers": ["github-actions"],
+      "groupName": "ci actions"
+    },
+    {
+      "description": "Group Docker base-image bumps (Dockerfile + compose)",
+      "matchManagers": ["dockerfile", "docker-compose"],
+      "groupName": "docker images"
+    },
+    {
+      "description": "Group the Android Gradle/Kotlin toolchain",
+      "matchManagers": ["gradle", "gradle-wrapper"],
+      "groupName": "android gradle"
+    },
+    {
+      "description": "Group web npm non-major bumps",
+      "matchManagers": ["npm"],
+      "matchUpdateTypes": ["minor", "patch"],
+      "groupName": "web npm (non-major)"
+    }
   ]
 }