chore(deps): group routine Dependabot updates

[Serph91P]

Summary

• group routine Python minor and patch updates in one pip-specific pull request
• group routine frontend minor and patch updates in one npm-specific pull request
• group routine Docker minor and patch updates in one Docker-specific pull request
• group routine GitHub Actions minor and patch updates in one Actions-specific pull request
• leave major updates outside the groups so they remain individually reviewable

Validation

• parsed .github/dependabot.yml with Ruby Psych
• verified exactly four updater entries and one ecosystem-local group per updater
• verified every group uses patterns: ["*"] and only minor plus patch update types
• verified all existing updater properties match develop exactly after removing the new group blocks
• verified matching pip, npm, Docker, and GitHub Actions sources exist
• git diff --check
• exact changed and staged path: .github/dependabot.yml
• U+2013 and U+2014 scan passed

Closes #779