fix(deps): remediate Astro security alerts

[ashwch]

What changed?

• Bump Astro from ^6.2.1 to ^7.1.0; npm resolves 7.1.4.
• Add a root npm Dependabot lane on default main, omitting target-branch so security-update grouping/options remain active.
• Group security updates and add controlled update cooldowns.
• Preserve the repository's intentional no-lockfile policy.

Alert coverage

This change raises Astro past every current patched threshold:

• GHSA-4g3v-8h47-v7g6 — patched in 7.1.0
• GHSA-f48w-9m4c-m7f5 — patched in 7.0.6
• GHSA-7pw4-f3q4-r2p2 — patched in 7.0.4

The alerts remain visible until this PR is merged and GitHub rescans main.

Validation

• npm install --package-lock=false — passed; 0 vulnerabilities reported
• npm ls astro --depth=0 — resolved astro@7.1.4
• npm run build — passed; 78 pages built
• Dependabot YAML parse — passed
• jq -e . package.json — passed
• git diff --check — passed
• No package-lock.json generated
• local-ci unavailable (no committed planner)

Scope

Files changed:

• .github/dependabot.yml
• package.json

[little-person]

Naboo CI commands

Naboo can answer read-only CI questions directly in this PR. Comment with one of these commands on its own line:

Command	What it does
/ci help	Show the command reference
/ci status	Show current check-run statuses for this PR
/ci explain	Show check statuses + CI routing/policy notes
/ci run (both / optimo / diversio / minimal)	Trigger Django4Lyfe backend CI manually (write/maintain/admin/allowlist only)
/ci run full	Legacy alias for /ci run both (write/maintain/admin/allowlist only)
/ci retry	Rerun the latest Django4Lyfe backend CI pipeline for this PR SHA (write/maintain/admin/allowlist only)
/ci cancel	Cancel the in-flight Django4Lyfe backend CI pipeline for this PR SHA (write/maintain/admin/allowlist only)

Read-only commands work everywhere Naboo is installed.
Manual backend commands are limited to Django4Lyfe and require write/maintain/admin/allowlist access,
direct CircleCI-control enablement, and repo permission.

Backend CI policy:

Every push                -> fast checks (lint, type) run free on GHA
Every push                -> Testmon subset lanes run on CircleCI
Full product suites       -> MANUAL ONLY via `/ci run ...`
Naboo explains            -> what changed and recommends a /ci command
You decide when           -> `/ci run both`, `/ci run optimo`, `/ci run diversio`

Run /ci explain to see the routing decision for this PR.

When you are ready, run the recommended /ci command to validate the full product suites. Naboo dedupes by branch + SHA so repeated commands do not create duplicate pipelines.

_{Commit small, review easy, merge happy.}

This one-time message is posted automatically when the PR opens.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.