chore(deps): consolidate 15 Dependabot bumps and auto-merge future ones

[ryanbaumann]

Replaces the 15 open Dependabot PRs (#196–#210) with one verified update, and sets up auto-merge so the backlog does not rebuild.

Dependency bumps

Package	Update	Replaces
demos/aqi-map	vite 8.2.0 → 8.2.1	#196
demos/isochrones	vite 8.2.0 → 8.2.1	#197
demos/strava-explorer	vite 8.2.0 → 8.2.1	#200
demos/strava-explorer	eslint 10.8.0 → 10.8.1	#202
demos/strava-explorer	@types/google.maps 3.65.4 → 3.65.5	#203
demos/hairstyle-ai-studio	vite 8.2.0 → 8.2.1	#205
demos/hairstyle-ai-studio	postcss 8.5.25 → 8.5.26	#199
demos/hairstyle-ai-studio	lucide-react 1.28.0 → 1.30.0	#210
demos/hairstyle-ai-studio	@types/node 26.1.2 → 26.2.0	#206
demos/hairstyle-ai-studio	@types/react-dom 19.2.3 → 19.2.4	#207
demos/real-world-reasoning-agent	vite 7.3.6 → 8.2.1	#208
demos/real-world-reasoning-agent	@deck.gl/layers 9.3.7 → 9.3.8	#201
demos/real-world-reasoning-agent	@deck.gl/geo-layers 9.3.7 → 9.3.8	#204
demos/real-world-reasoning-agent	@types/react-dom 19.2.3 → 19.2.4	#198
demos/real-world-reasoning-agent	jsdom 25.0.1 → 29.1.1	#209 (see below)

One deviation: jsdom 29.1.1, not 30.0.1

PR #209 proposed jsdom 30.0.1. That release requires node ^22.22.2 || ^24.15.0 || >=26.0.0, while CI pins Node 20 and every package engines field targets Node 20/20.19. On 30.0.1 the vitest jsdom environment fails to boot on Node 20:

TypeError: webidl.util.markAsUncloneable is not a function
 ❯ new CacheStorage node_modules/undici/lib/web/cache/cachestorage.js:20:17
 ❯ Object.<anonymous> node_modules/jsdom/lib/api.js:12:33

29.1.1 is the newest jsdom that still supports Node 20 (^20.19.0 || ^22.13.0 || >=24.0.0). Taking jsdom 30 would require moving CI and the Dockerfile to Node 22+ first — worth doing, but it is a separate change from a dependency sweep.

Auto-merge going forward

• .github/workflows/dependabot-auto-merge.yml — on a Dependabot PR, enables GitHub auto-merge (squash). Branch protection still gates the actual merge behind every required check in ci.yml, so a red build leaves the PR open exactly as today. Majors are excluded and get a "review me" comment instead — the jsdom case above is precisely the break a green-tests gate does not catch on its own.
• .github/dependabot.yml — each ecosystem now groups its weekly minor and patch bumps into a single PR. Fifteen one-line PRs cost more review attention than the updates were worth.

Repo-level "Allow auto-merge" must be on for the workflow to take effect.

Verification

Run locally on Node 20.20.2, all green:

• demos/aqi-map — npm test (node --test + build)
• demos/isochrones — npm test (node --test + build)
• demos/strava-explorer — npm run lint, npm test (38 passed), npm run build
• demos/hairstyle-ai-studio — npm run check (typecheck + vitest + build)
• demos/real-world-reasoning-agent — npm test (typecheck + 505 vitest tests + source check), npm run build (vite 8)
• root — npm run check:labs, npm run check:content, npm run test:labs (48 passed)

🤖 Generated with Claude Code