chore(deps): batch 14 bumps and make Dependabot grouping catch-all

[agjs]

Summary

• Batches the 14 Dependabot PRs from the third wave this morning.
• Fixes the cause of the churn: groups was an allowlist, so every package outside ~11 named families got its own PR. Now catch-all across all eight ecosystems.
• Narrows a dead re-export that knip 6.32.0 newly (and correctly) flagged.

Closes #386, #387, #388, #389, #390, #391, #392, #393, #394, #395, #396, #397, #398, #399

Why 14 PRs appeared

Not a Dependabot bug — the config. groups named ~11 families (elysia, drizzle, bullmq, email, lint, observability, ai, react, tanstack, testing, storybook, tailwind-shadcn) and everything else fell through individually:

PR(s)	Why it was alone
@opentelemetry/* ×4	observability covers @sentry/* and pino — not otel
knip ×2	ungrouped, and the same package in both api and ui
react-i18next	react group is only react/react-dom/types/router
wrangler	apps/docs had no groups block at all
tsx, @vitejs/plugin-react, @types/node, lint-staged, fs-extra, @changesets/cli	ungrouped long tail

14 PRs for 14 ungrouped packages. github-actions, all three docker blocks and terraform had no groups either, so every action and image bump was its own PR too. The allowlist approach is whack-a-mole: the tail regrows with every new dependency.

The fix

Replaces named groups with catch-all patterns: ["*"] split by dependency-type:

groups:
  production-dependencies:
    dependency-type: "production"
    patterns: ["*"]
  development-dependencies:
    dependency-type: "development"
    patterns: ["*"]

Applied to all three bun ecosystems, plus a single "*" group for github-actions, the three docker blocks and terraform (where dependency-type doesn't apply).

Effect: at most two PRs per app per week instead of ~20 — runtime deps kept separate from tooling so review risk stays distinguishable — and nothing to maintain as dependencies are added. All existing major-ignores are untouched.

One consequence worth knowing: React's pins now split across sibling PRs, since react/react-dom/react-router-dom are production while @types/react/@types/react-dom are development. The overrides entries mirroring them must still move in lockstep; package-override-parity catches it if they drift. Noted in a comment on the block.

knip 6.32.0 — true positive

apps/ui/src/lib/api/client.ts re-exported paths, components and operations from ./schema. knip 6.32 tightened unused-re-export detection and flagged the first two. It's right:

• paths is imported straight from @/lib/api/schema at its one use site (AuditLog.types.ts), never through this barrel
• components isn't referenced anywhere
• operations is consumed via the barrel in ~8 feature type modules

Narrowed the re-export to operations.

Test plan

Full local verification, smoke stack booted by the gate:

• cd apps/api && bun run check — typecheck, lint, lint:meta, knip clean
• cd apps/api && bun test — 1192 pass, 1 skip, 0 fail
• cd apps/ui && bun run check — lint, lint:meta, format, typecheck, knip clean
• cd apps/ui && bun run test:ci — 656 pass across 152 files
• cd apps/ui && bun run build && size:check && size:check:modulepreload — all budgets pass, 13 preload assets covered
• cd apps/docs && bun run build:ci — plus fragments, rendered-markdown, docs-data, components, scripts-docs, lint-meta-docs
• osv-scanner clean in all three apps
• Full pre-push gate passed, including the compose smoke stack

Dependabot config changes can't be validated by CI — they only take effect on the next scheduled run. Expect the next wave as ~2–3 grouped PRs rather than ~20; if the grouping is wrong it shows up as PR volume, not a broken build.

Conventions

• No any / as / !
• No env var changes
• Tests updated for changed behavior — none needed; the only source change removes two unused type re-exports

Screenshots

Not applicable — no UI behavior change.