chore: improve dev tooling (CI tests, dependabot, coverage) (#169)

- Add frontend unit tests with coverage to CI test workflow
- Add dependabot.yml for automated dependency updates (npm + GitHub Actions)
- Add backend coverage thresholds (60/65/50/60) to vitest.config.ts
- Exclude services/ and logger from coverage (untestable schedulers)

.github/copilot-instructions.md

@@ -8,7 +8,7 @@ Use `AGENTS.md` as the canonical governance source and `.github/skills/*/SKILL.m
 ## Always-On Rules
 
 - English only for project artifacts.
-- No remote git/release actions by normal agent (`git push`, PR create/merge, tag/release).
+- **NEVER run remote git commands** — no `git push`, no `gh pr create/merge`, no `gh release`, no `git tag`. Prepare locally, then hand off to `@release-manager`.
 - Testing work belongs to `@testing-manager`.
 - PR/release/CI orchestration belongs to `@release-manager`.
 - Keep changes local, focused, and consistent with existing UI/API patterns.

.github/dependabot.yml

@@ -0,0 +1,53 @@
+version: 2
+
+updates:
+  # Backend dependencies
+  - package-ecosystem: "npm"
+    directory: "/backend"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+    groups:
+      minor-and-patch:
+        update-types:
+          - "minor"
+          - "patch"
+
+  # Frontend dependencies
+  - package-ecosystem: "npm"
+    directory: "/frontend"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+    groups:
+      minor-and-patch:
+        update-types:
+          - "minor"
+          - "patch"
+
+  # Root dev dependencies
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+
+  # GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "ci"

.github/workflows/test.yml

@@ -81,7 +81,7 @@ jobs:
           retention-days: 7
 
   # =============================================================================
-  # Frontend Build Validation (skipped if no frontend-related files changed)
+  # Frontend Tests & Build (skipped if no frontend-related files changed)
   # =============================================================================
   frontend-build:
     name: Frontend Build
@@ -111,5 +111,16 @@ jobs:
       - name: Lint
         run: npm run lint
 
+      - name: Run tests with coverage
+        run: npm run test:coverage
+
       - name: TypeScript type check & build
         run: npm run build
+
+      - name: Upload coverage report
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: frontend-coverage
+          path: frontend/coverage/
+          retention-days: 7

backend/vitest.config.ts

@@ -14,5 +14,25 @@ export default defineConfig({
     },
     // Timeout for longer integration tests
     testTimeout: 10000,
+    coverage: {
+      provider: "v8",
+      reporter: ["text", "json", "html"],
+      include: ["src/**/*.ts"],
+      exclude: [
+        "src/test/**",
+        "src/**/*.d.ts",
+        "src/**/index.ts",
+        "src/services/**",
+        "src/utils/logger.ts",
+      ],
+      thresholds: {
+        global: {
+          lines: 60,
+          functions: 65,
+          branches: 50,
+          statements: 60,
+        },
+      },
+    },
   },
 });