#115 [High] Extend `.github/dependabot.yml` coverage and add an auto-merge policy for low-risk updates

[james2177]

Description: .github/dependabot.yml exists but its current scope/ecosystem coverage should be audited and extended (e.g. ensure it covers the npm ecosystem for both root dependencies and any GitHub Actions version pins used in .github/workflows/ci.yml), and there is no auto-merge policy — every dependency bump, including trivial patch-level ones, currently requires full manual review.

Problem Statement & Context: The existing vulnerability-scan CI job (npm audit --audit-level=high) is reactive — it flags known-vulnerable versions already in use, while Dependabot is the proactive half of dependency hygiene. Under-scoped Dependabot config plus no auto-merge policy means low-risk patch bumps pile up unreviewed, which in turn increases the surface npm audit has to catch reactively.

Scope & Acceptance Criteria:

• Audit and extend .github/dependabot.yml to explicitly cover both the npm package ecosystem and the github-actions ecosystem (action version pins in .github/workflows/ci.yml).
• Add a scoped auto-merge policy (e.g. via a GitHub Actions workflow gated on Dependabot PRs that are patch-level and pass the full backend CI job) — explicitly excluding major/minor bumps from auto-merge.
• Out of scope: auto-merging any dependency with a security advisory (those should get expedited manual review, not silent auto-merge) — the policy must exclude these explicitly, even if npm audit would otherwise pass.
• Out of scope: relaxing the vulnerability-scan job's --audit-level=high threshold (see issue Add retry/backoff for failed Soroban transaction submission #29 for that work).

Implementation Guidelines:

1. Key files: .github/dependabot.yml, .github/workflows/ci.yml.
2. Gate auto-merge on the full existing backend matrix job (both Node 20 and 22) passing, not just a subset.
3. Use GitHub-native auto-merge (gh pr merge --auto) triggered from a workflow that checks the PR is Dependabot-authored and patch-level via the PR title/labels Dependabot applies, rather than building custom merge tooling.
4. Testing: validate on a real Dependabot patch-bump PR (or a simulated one) that auto-merge triggers correctly and that a simulated minor/major bump does NOT auto-merge; document both cases in the PR.

Definition of Done:

• Dependabot config extended, auto-merge policy implemented and scoped correctly.
• Acceptance criteria met.
• PR passes CI, includes evidence of both the auto-merge and non-auto-merge cases.
• Reviewed and approved.

Resources: .github/dependabot.yml, .github/workflows/ci.yml

Complexity: High (200 points)