[Rasalas]

Consolidates the nine open Dependabot PRs into one update and configures Dependabot to open one weekly version-update PR covering npm, Cargo and GitHub Actions. Security updates remain independent of the weekly group. The group includes all version updates, including major releases, which still require review before merging.

Supersedes #90, #92, #93, #95, #96, #102, #104, #105 and #106.

• Apply the npm development and production dependency updates, refresh compatible vulnerable dependencies in the lockfile, and retain the requested Rust versions: Tauri 2.11.0, tauri-build 2.6.0, single-instance 2.4.2, fs 2.5.1 and dialog 2.7.1.
• Upgrade actions/checkout and actions/setup-node to v7 in CI, deployment and desktop release workflows.
• Compile the desktop app in CI on Linux, macOS and Windows. Previously, Rust dependency PRs only ran JavaScript checks.
• Fix a navigation integration-test race: a fixed 100 ms wait could finish before FileReader callbacks under load. Wait for the expected message count and cover file reads delayed by 150 ms.

Validation: 647 tests across 22 suites, ESLint, production web build, locked macOS cargo check, actionlint and Dependabot configuration schema validation passed locally. Cargo check also passes without a built frontend, matching the new CI job.

npm audit --omit=dev reports zero vulnerabilities. Compatible fixes reduce high-severity findings from 14 on main to 5; the remaining high findings are the existing braces/gh-pages development-tool chain. npm's suggested force fix would downgrade tools and is outside this update. The security workflow retains its existing advisory-only behavior.