chore(deps): clear the open Dependabot alerts and configure version updates

[jeroenrinzema]

Clears the open Dependabot alerts across all four ecosystems and adds the
.github/dependabot.yml that was never there, which is why transitive
dependencies drifted until an advisory forced the issue.

Supersedes #319, #320, #321 and #322.

Result

Area	Before	After	Verified with
go.mod	29	4	go build, go vet, short tests
console	136	0	pnpm audit clean; build, lint, 83/83 tests
docs	89	2	pnpm audit; site builds incl. OG images
modules/webhook/preview	12	0	npm audit clean; identical bundle output

The Go figure was checked by comparing each alert's patched version against
the resolved module graph: 25 of 29 cleared.

The six that remain have no fix in existence

• github.com/docker/docker (4 alerts) — the fix ships in Docker 29,
  which moved to a versioned module path. Unreachable until
  testcontainers-go migrates. Test-only, via internal/container.
• image-size (2 alerts) — no patched release at any version
  (GHSA-5p2g-fcmc-qvqq, GHSA-w3rx-r6r6-pgpr). Build-time only, via
  fumadocs-core, over images committed to this repository.

Why this is not just the Dependabot PRs

109 of the 237 npm alerts sit behind parents that pin a vulnerable range —
shadcn's MCP SDK chain, eslint, fumadocs, next, monaco-editor.
Reaching those needs pnpm.overrides / npm overrides, which Dependabot
does not write; 76 of the 89 docs alerts are in that bucket. The Go PRs
had no such limitation and land the same targets as the Go commit here.

Approach

Direct dependencies move to the lowest release carrying each fix, not
@latest — a @latest pass pulled React Router to v8 and uuid to v14,
and landed Clerk on 5.61.3, below the 5.61.6 its critical advisory
requires. Transitives are refreshed by name rather than with a blanket
pnpm update, which had rewritten nearly every range in
console/package.json.

Every override is capped to its own major. Packages present at more than
one major (ajv, brace-expansion, minimatch, picomatch) are keyed
per major — an uncapped ajv override jumped to 8.x and broke ESLint.

happy-dom becomes an explicit devDependency in console, since overrides
do not apply to peers pnpm resolves on its own.

dependabot.yml

Covers the Go module, the three npm workspaces, the workflows plus their
composite action, and the root Dockerfiles. Minor and patch updates are
grouped per ecosystem to keep PR volume reviewable; majors still arrive on
their own.

Two fixes the upgrade forced

go directive across the nested modules. openfga v1.18.0 requires Go
1.25.7, which raises the root module's directive. All twelve nested modules
replace the root, and a module cannot depend on one requiring a newer Go
than it declares, so go generate failed on the TinyGo build. Verified
against TinyGo 0.40.1, which itself builds on Go 1.25.7.

rbac.Migrate connection timeouts. openfga v1.18.0 feeds
MigrationConfig.Timeout and PingTimeout straight into the connection
backoff. Both were left at zero, which means an unbounded MaxElapsedTime
and a ping context that expires the moment it is created — RunMigrations
spun in a tight retry loop instead of connecting. internal/rbac hung to
the test timeout; it now passes in eight seconds. The loop also pegged a
core, starving packages sharing the runner under -p 4, which is what
pushed internal/wasm (200s to 1269s) and internal/wasm/integrations
(29s to 1139s) past their limits on a two-core machine.

This second commit is a behaviour change in production code rather than a
dependency bump. It is here because the upgrade exposed it, but it warrants
review on its own terms.

Per-package timings are back to their main baselines: internal/wasm
203.7s, internal/wasm/integrations 30.1s, internal/rbac 8.3s.