Dependabot merge criteria caused CD failure

**What happened**

PRs #3846 and #3849 triggered Auth API CD failures (#1671, #1672) — DB migration job failed, traffic auto-rolled back to previous revision. No prod/customer impact. Both PRs reverted, CD confirmed healthy after.

**Root cause**

Both PRs only updated poetry.lock, not pyproject.toml, Mis-judged during batch cleanup.

Also: cryptography was a 2-major-version jump (48→50), pulled in indirectly (via db driver). Changelog likely affected SSL/TLS handshake used by the migration job's DB connection. "Indirect dependency, lock-only" ≠ low risk when it's a crypto/db-adjacent library.

**Proposed fixes**

Tighten merge rule: require actual version bump in pyproject.toml/package.json, not just lock file
Group Dependabot PRs via dependabot.yml (groups, cross-directory grouping) to reduce PR volume and manual triage errors
Review branch protection rules — currently blocking Dependabot's own dependabot/** branches, causing @dependabot rebase/recreate to fail and forcing manual close/recreate workarounds
Maintain a watchlist of high-risk deps (cryptography, psycopg2, SQLAlchemy, alembic, etc.) that always require manual review regardless of dependency type

**Action items**

- [ ] Align team on updated merge criteria
- [ ] Configure dependabot.yml grouping
- [ ] Review/adjust branch protection scope

Start by inspecting dependabot.yml, pyproject.toml, package.json, and the repository's branch protection settings. Review how dependency PRs are grouped and currently judged for merging, then confirm the updated criteria, grouping, Dependabot branch access, and high-risk dependency review process are documented and configured.

Written by the indexing model from the issue text.