chore(deps): tune Dependabot (monthly, no rebase churn, majors manual)

.github/dependabot.yml

@@ -1,52 +1,70 @@
 # Dependabot configuration for SplitIt.
 # Keeps NuGet, npm, GitHub Actions and Docker base images up to date and surfaces
 # known vulnerabilities as security alerts/PRs.
+#
+# Tuned to stay quiet and safe:
+#   - monthly schedule and rebase-strategy: disabled → no weekly PR/rebase churn.
+#   - explicit open-pull-requests-limit for every ecosystem.
+#   - major version updates are ignored on purpose: majors are planned manual
+#     upgrades (framework migrations, base image jumps), not bot PRs. Minor and
+#     patch updates keep flowing, grouped into one PR per ecosystem.
+#   - Dependabot security alerts are not affected by these settings.
 version: 2
 updates:
   # .NET backend (solution lives in SplitIt.API, tests in SplitIt.Tests).
   - package-ecosystem: "nuget"
-    directory: "/SplitIt.API"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    groups:
-      nuget-minor-patch:
-        patterns: ["*"]
-        update-types: ["minor", "patch"]
-
-  - package-ecosystem: "nuget"
-    directory: "/SplitIt.Tests"
+    directories:
+      - "/SplitIt.API"
+      - "/SplitIt.Tests"
     schedule:
-      interval: "weekly"
+      interval: "monthly"
     open-pull-requests-limit: 5
+    rebase-strategy: disabled
     groups:
       nuget-minor-patch:
         patterns: ["*"]
         update-types: ["minor", "patch"]
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
 
   # Node tooling: root orchestration package and the Angular app.
   - package-ecosystem: "npm"
     directories:
       - "/"
       - "/split-it-ui"
     schedule:
-      interval: "weekly"
+      interval: "monthly"
     open-pull-requests-limit: 5
+    rebase-strategy: disabled
     groups:
       npm-minor-patch:
         patterns: ["*"]
         update-types: ["minor", "patch"]
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
 
   # Workflow actions and Docker base images.
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "weekly"
+      interval: "monthly"
+    open-pull-requests-limit: 5
+    rebase-strategy: disabled
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
 
   - package-ecosystem: "docker"
     directories:
       - "/docker/backend"
       - "/docker/frontend"
       - "/docker/proxy"
     schedule:
-      interval: "weekly"
+      interval: "monthly"
+    open-pull-requests-limit: 5
+    rebase-strategy: disabled
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]