chore(security): add Dependabot security-update config

[nicolasiscoding]

Closes #6

Summary

• Adds .github/dependabot.yml configured for security-only updates (npm ecosystem at /evals/overlay-accuracy)
• Modeled on the working TurboDocx/html-to-docx Dependabot config
• open-pull-requests-limit: 0 means Dependabot will only surface security-alert PRs (CVE fixes), not routine version-bump noise
• Part of the patch-duty tooling audit rolling this config out across TurboDocx repos

Test plan

• Confirm Dependabot picks up the config and begins scanning for vulnerable npm dependencies under /evals/overlay-accuracy
• Verify no non-security PRs are opened (limit is 0)

[nicolasiscoding]

🤖 Automated code review (Claude, light effort)

Reviewed this PR's .github/dependabot.yml diff. Checked: valid YAML, every package-ecosystem/directory pair maps to a real manifest in this repo, target-branch matches the repo's actual default branch, and open-pull-requests-limit: 0 is intact on every entry (so this stays security-fix-only — no routine version-bump PR noise was introduced).

Findings: none. No correctness issues found at light-review depth.

This comment and the underlying review were written by Claude (Anthropic), run by @nicolasiscoding as part of a patch-duty tooling rollout — not a human reviewer. Treat as an automated check, not a substitute for a real approval.

[nicolasiscoding]

apprvoed