Add Dependabot and CI test workflow

## Requirement

Add two GitHub automation improvements to keep the repo healthy as an open-source project:

1. **Dependabot** — automatically open PRs when Python dependencies in `requirements.txt` have new versions
2. **CI — run tests on PRs** — run `pytest` automatically on every pull request so regressions are caught before merge

## Tasks

- [ ] Add `.github/dependabot.yml` to enable weekly dependency update PRs for `pip` ecosystem
- [ ] Add `.github/workflows/test.yml` GitHub Actions workflow that runs `python -m pytest tests/ -v` on every PR and push to `main`

## Notes

- Tests already work locally with no external dependencies (all mocked via `conftest.py`)
- `conftest.py` sets all required env vars so no secrets are needed in CI

## Current Test Coverage

Good coverage exists across all 4 modules:

| File | What's covered |
|------|----------------|
| `test_auth.py` | OAuth discovery endpoints, Google redirect, state storage, callback flow, PKCE validation (correct/wrong/missing verifier), invalid code |
| `test_google_chat.py` | Pagination, 500-message cap, date range filtering, case-insensitive search |
| `test_token_store.py` | Insert new user, upsert existing, get/update/delete tokens and auth codes |
| `test_server.py` | Health check, MCP endpoint exists |

## Missing Test Coverage (good first contributions)

- [ ] **Token refresh path** — `server.py` logic when Google access token is expired has no test
- [ ] **MCP tools end-to-end** — `list_spaces`, `get_messages`, `search_messages` are only tested at the Google Chat client level, not through the full MCP server stack
- [ ] **`MCPAuthMiddleware`** — the 401 response and browser redirect logic is untested

Start by reading requirements.txt, conftest.py, and the existing tests to confirm the dependency ecosystem and local command. Add .github/dependabot.yml and .github/workflows/test.yml as specified, then run python -m pytest tests/ -v locally. Done means weekly pip update PRs are configured and the test workflow runs on pull requests and pushes to main.

Written by the indexing model from the issue text.