Consolidate dependency updates and batch Dependabot releases

[seenu-k]

The dependency backlog currently needs eight separate merges and releases. This PR consolidates the compatible updates into one merge and configures Dependabot to open one weekly routine-update PR across the Flutter app, generated API package, Worker, service worker, GitHub Actions and Fastlane.

Included updates

• Supersedes Dependabot Bump fastlane from 2.240.0 to 2.240.1 #11, Bump the better-auth group in /server with 3 updates #21, Bump share_plus from 13.3.0 to 13.3.1 #22, Bump url_launcher from 6.3.2 to 6.3.3 #23, Bump flutter_timezone from 5.1.0 to 5.1.1 #24, Bump package_info_plus from 10.2.1 to 10.2.2 #25, Bump the toolchain group in /server with 5 updates #27 and Bump hono from 4.13.11 to 4.13.13 in /server #28: Fastlane 2.240.1, Better Auth/adapter/CLI 1.7.7, share_plus 13.3.1, url_launcher 6.3.3, flutter_timezone 5.1.1, package_info_plus 10.2.2, Hono 4.13.13 and the server toolchain.
• Vitest 5.0.3 is explicitly approved. Pair it with Cloudflare's Vitest plugin 1.4.0, which supports Vitest 5; the 1.3.6 plugin proposed by Bump the toolchain group in /server with 5 updates #27 still declares Vitest 4 peers. The lockfile resolves Wrangler 4.149.0 and Node types 26.6.5. Regenerate Wrangler runtime types and update the Biome schema to 2.5.15.
• Add Drift 2.35.2, whose upstream fix addresses the OPFS nested transaction regression referenced by this app's comments. Refresh its released browser worker; drift_dev remains on its latest published 2.35.1. No database schema or migration changes.
• Correct stale analyzer/OpenAPI limitation comments and record the evidence in docs/upstream-workarounds.md. The analyzer's qualified-ignore behavior is verified; the nullable-component OpenAPI issue is reproduced and its workaround retained. A minimal discriminated-union probe against OpenAPI Generator 7.26.0 still generates an invalid combined model: it requires strandedUserId for the kept branch and emits only the replaced enum value. Keep the flattened wire model and pinned generator. Drizzle's proposed RC retains the synchronous transaction typing constraint, so the boxed return remains appropriate.

Dependabot policy

Use GitHub's native multi-ecosystem-groups feature for one weekly minor/patch batch, without automerging. Major upgrades are planned manually. Hold the unreviewed Drizzle RCs and connectivity_plus 7.3.2, whose dbus requirement conflicts with stable notifications. Security updates can still arrive independently of the weekly version-update batch. Extend coverage to service_worker and packages/opensplit_api.

Explicit deferrals and deployment note

• Bump the drizzle group across 1 directory with 2 updates #13: keep Drizzle ORM and kit on 1.0.0-rc.4; the commit-suffixed rc.5 prerelease is deferred by request.
• Bump connectivity_plus and flutter_local_notifications #26: keep flutter_local_notifications 22.3.1 and connectivity_plus 7.3.1. The notification prerelease requires coordinated Android AGP/Gradle/SDK changes; both updates are deferred by request.
• Better Auth 1.7.7 is the approved security patch. Google sign-ins already in progress when it is deployed must restart; existing sessions remain valid and no auth database migration is required.
• This PR does not merge or publish anything. Its eventual single merge to main uses the existing release workflow once; maintenance notes are under Unreleased.

Validation

All four CI jobs pass on fde1449: Analyse and test, Backend and adapter tests, Release tooling, and Web bundle.

• Server lint, TypeScript checks and 280 server tests pass with the new Vitest/Cloudflare plugin pair.
• Auth schema generation, all three Drizzle migration generators, Wrangler type generation, API client consistency, and Drift schema regeneration checked.
• Service worker typechecks and 12 tests pass. Fastlane configuration and mock upload tests pass without publishing.
• Dart analysis/formatting, 567 Flutter tests, 180 Chrome tests, and 3 Chrome/WASM OPFS tests pass after the Drift patch. The production web bundle builds successfully.
• Android release APK validation passes using env/ci.example.json and a temporary Gradle init script selecting debug signing for this local invocation. The first attempt reached signing but the ignored local upload-key configuration references a missing keystore; no repository signing settings were changed. Nothing was uploaded. The build still reports the existing legacy-Kotlin warnings for firebase_core and in_app_review; the current compatibility flags are retained.

The original #27 failure was stale generated Wrangler types. #24's failing backend alarm assertion is unrelated to its Flutter timezone patch; the combined server suite passes.