chore: Phase 7 verification — Dependabot policy, CodeQL fixes

[shubhamaniket]

Summary

Phase 7 (final verification). Dependency policy after triaging Dependabot's first PRs, and fixes for CodeQL's first full scan of main. The verification itself (fresh clone, both quick starts, tests, requests.http, secrets scan) found no other issues.

• dependabot.yml: ignore major versions for NuGet, npm and Docker images (.NET 8 LTS, Node 22 LTS and React 18 are deliberate; majors are planned upgrades). Triage of build(deps): Bump actions/setup-dotnet from 4 to 6 #21–Bump Swashbuckle.AspNetCore from 6.6.2 to 10.3.0 #36: 7 safe updates merged, 9 major-version updates closed with reasons.
• CodeQL (17 non-security alerts on main): 10 fixed in code (undisposed requests in test helpers, a simplifiable boolean, a redundant cast, 5 missing <summary> comments); 7 dismissed with reasons (5 in generated regex code, 2 intentional catch-alls implementing failure isolation).

Tasks covered

• Dependabot triage and policy
• Fresh clone → Quick start A (Docker) and B (no Docker) exactly as written
• Tests green locally and in CI; Swagger and requests.http (34/34)
• Secrets scan of all 138 commits (clean); repository public, secret scanning on (0 alerts)
• CodeQL first full-scan alerts addressed

Impact analysis

• Modules / APIs / data flows affected: .github/dependabot.yml; test helpers (dispose requests); doc comments on 5 public members; one test fake. No behaviour, API, contract or schema change.
• Schema changes / migrations: none.
• Backward compatibility: unchanged.

AI assistance

• Generated: 1 accepted as proposed | Edited: 1 | Rejected: 0 (see docs/ai-usage-log.md #102–#103)
• The AI's own test helpers and doc comments caused 15 of the 17 CodeQL alerts; fixed. Combined result of the merged Dependabot PRs re-verified on main (two of them changed the same lockfile).

Quality gates

• Build passes (warnings as errors)
• dotnet format clean
• Unit + integration tests pass (244 + 141; web 38)
• No vulnerable packages
• CodeQL clean (non-security alerts fixed or dismissed with reasons)

High-impact change sign-off (engineer)

• DB migration reviewed (up/down, data safety): none
• Redirect path reviewed (performance, failure isolation): not changed
• Input validation / security reviewed: not changed
• New dependencies justified: none added; dependency update policy changed (majors ignored), approved by the engineer