Dependabot merge criteria caused CD failure

**What happened**

PRs #3846 and #3849 triggered Auth API CD failures (#1671, #1672) — DB migration job failed, traffic auto-rolled back to previous revision. No prod/customer impact. Both PRs reverted, CD confirmed healthy after.

**Root cause**

Both PRs only updated poetry.lock, not pyproject.toml, Mis-judged during batch cleanup.

Also: cryptography was a 2-major-version jump (48→50), pulled in indirectly (via db driver). Changelog likely affected SSL/TLS handshake used by the migration job's DB connection. "Indirect dependency, lock-only" ≠ low risk when it's a crypto/db-adjacent library.

**Proposed fixes**

Tighten merge rule: require actual version bump in pyproject.toml/package.json, not just lock file
Group Dependabot PRs via dependabot.yml (groups, cross-directory grouping) to reduce PR volume and manual triage errors
Review branch protection rules — currently blocking Dependabot's own dependabot/** branches, causing @dependabot rebase/recreate to fail and forcing manual close/recreate workarounds
Maintain a watchlist of high-risk deps (cryptography, psycopg2, SQLAlchemy, alembic, etc.) that always require manual review regardless of dependency type

**Action items**

- [ ] Align team on updated merge criteria
- [ ] Configure dependabot.yml grouping
- [ ] Review/adjust branch protection scope

Start by reviewing the proposed dependabot.yml grouping and the repository's branch protection settings, then compare the current merge criteria with pyproject.toml and package.json updates. Confirm how the Auth API CD migration job handles dependency changes and document the updated criteria, grouping, protection scope, and high-risk dependency review path as complete.

Written by the indexing model from the issue text.