Track dependency updates with Dependabot

Add a weekly Dependabot configuration for pip, the Dockerfile base image,
and the GitHub Actions used by the publish workflow.

The Seafile AppImage is fetched by URL with a pinned checksum, which
Dependabot cannot resolve, so it stays a manual bump.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.github/dependabot.yml

@@ -0,0 +1,35 @@
+version: 2
+
+updates:
+  # Python runtime dependencies pinned in requirements.txt.
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+    commit-message:
+      prefix: pip
+
+  # Base image in the Dockerfile. The Seafile AppImage is fetched by URL and
+  # checksum, so Dependabot cannot track it; bump SEAFILE_CLI_VERSION and
+  # SEAFILE_CLI_SHA256 by hand.
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: weekly
+    labels:
+      - dependencies
+    commit-message:
+      prefix: docker
+
+  # Actions used by .github/workflows.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    labels:
+      - dependencies
+    commit-message:
+      prefix: ci

IMPROVEMENTS.md

@@ -156,7 +156,10 @@ Acceptance criteria:
   the same manifest digest.
 - [x] Add OCI labels via `docker/metadata-action`.
 - [ ] Add an SBOM, provenance, and image signing.
-- [ ] Add dependency updates for Python, Docker, and GitHub Actions.
+- [x] Add dependency updates for Python, Docker, and GitHub Actions. A weekly
+  Dependabot configuration covers `requirements.txt`, the Dockerfile base
+  image, and the workflow actions. The Seafile AppImage is fetched by URL and
+  checksum, so it still has to be bumped by hand.
 - [ ] Run dependency and image scans on pull requests and on a schedule.
 
 Acceptance criteria: