ci: security-only Dependabot + weekly poetry.lock updates

[blink1073]

References

Description

Splits dependency updates into two lanes: Dependabot now handles security
fixes only (low noise, high signal), and a new weekly workflow batches
routine poetry.lock version bumps into one PR. Pattern per
https://gist.github.com/blink1073/4c4792b1ae70bdc57ccafaa7ad889f88.

Changes

• Fix a mixed-type array in pyproject.toml's [dependency-groups].typing
  (was mixing a table entry with plain strings) — this is the exact pattern
  that crashes Dependabot's Poetry resolver (toml-rb), so it had to be split
  into homogeneous groups (typing-extra + typing) before the security-only
  lane could be trusted to keep working.
• Remove unused uv.lock (nothing in the repo referenced it; Poetry is the
  actual dependency manager here).
• Add open-pull-requests-limit: 0 to the pip entry in
  .github/dependabot.yml, restricting it to security-triggered PRs only.
• Add .github/workflows/lock-update.yml: a weekly (Monday 6am UTC) +
  manually-dispatchable workflow that runs poetry update --lock under a
  7-day minimum release-age cooldown and opens a single PR (labeled
  maintenance) if poetry.lock changed. Modeled on the existing
  pre-commit-autoupdate.yml workflow's conventions (same release
  environment, checkout pin, fork guard, persist-credentials: false).

Backwards-incompatible changes

None

Testing

• just pre-commit — all hooks pass
• just typing — mypy clean
• just test — 174/174 passing
• Verified live against the repo: Dependabot security updates remain
  enabled and no in-flight Dependabot PR is dropped by this change
  (gh pr list --author app/dependabot returns none currently open)

AI usage

• Some or all of the content of this PR was generated by AI.
• The human author has carefully reviewed this PR and run this code.
• AI tools and models used: Claude Code (Sonnet 5 for implementation and per-task review, Opus 5 for the final whole-branch review)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.93%. Comparing base (fa68d09) to head (f0c20b0).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #357   +/-   ##
=======================================
  Coverage   92.93%   92.93%           
=======================================
  Files           6        6           
  Lines         439      439           
=======================================
  Hits          408      408           
  Misses         31       31           

Flag	Coverage Δ
linux	92.71% <ø> (ø)
windows	92.93% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.