Dependabot merge criteria caused CD failure

**What happened**

PRs #3846 and #3849 triggered Auth API CD failures (#1671, #1672) — DB migration job failed, traffic auto-rolled back to previous revision. No prod/customer impact. Both PRs reverted, CD confirmed healthy after.

**Root cause**

Both PRs only updated poetry.lock, not pyproject.toml, Mis-judged during batch cleanup.

Also: cryptography was a 2-major-version jump (48→50), pulled in indirectly (via db driver). Changelog likely affected SSL/TLS handshake used by the migration job's DB connection. "Indirect dependency, lock-only" ≠ low risk when it's a crypto/db-adjacent library.

**Proposed fixes**

Tighten merge rule: require actual version bump in pyproject.toml/package.json, not just lock file
Group Dependabot PRs via dependabot.yml (groups, cross-directory grouping) to reduce PR volume and manual triage errors
Review branch protection rules — currently blocking Dependabot's own dependabot/** branches, causing @dependabot rebase/recreate to fail and forcing manual close/recreate workarounds
Maintain a watchlist of high-risk deps (cryptography, psycopg2, SQLAlchemy, alembic, etc.) that always require manual review regardless of dependency type

**Action items**

- [ ] Align team on updated merge criteria
- [ ] Configure dependabot.yml grouping
- [ ] Review/adjust branch protection scope

Start by reviewing the failed PRs #3846 and #3849 and the related CD failures #1671 and #1672. Inspect dependabot.yml, pyproject.toml, package.json, lock files, and the repository's branch protection settings. Done means the updated merge criteria, dependency grouping, and Dependabot branch handling are documented or configured and the migration CD path remains healthy.

Written by the indexing model from the issue text.