Automated dependency security scanning + CI pipeline

Added automated dependency security scanning (Dependabot) and a CI pipeline with test coverage across both the open-source and production codebase.

• Dependabot now watches every dependency in both repos and opens weekly update PRs
• CI runs the full build and test suite on every pull request before it can merge
• Backend tests run against a real Postgres instance, matching production