feat(renovate): add self-hosted Renovate config and Gitea Actions workflow

Run the pinned renovate/renovate image on the host runner every weekday at
04:17 (plus workflow_dispatch) against the gitea platform, authenticating with
the renovate-bot RENOVATE_TOKEN Actions secret. Minor and patch updates are
grouped and automerged only after CI passes; majors wait for dashboard
approval. Document the bot, secret rotation and the minimumReleaseAge policy in
the error-centre runbook.

docs/operations/cms-error-center.md

@@ -56,9 +56,18 @@ Lenis has been removed; the public site now uses native scrolling. Other used
 runtime libraries remain. Vitest and its coverage provider are upgraded together;
 `clearMocks: false` preserves initialization-time permission contract assertions.
 
-Dependency updates are manual: Renovate has been removed, so there is no bot
-opening upgrade pull requests. Node/pnpm upgrades remain coordinated with
-Docker and the runner toolchain.
+Dependency updates run through self-hosted Renovate: `renovate.json` plus
+`.gitea/workflows/renovate.yaml` run the pinned `renovate/renovate` image on the
+host runner every weekday at 04:17 (and via `workflow_dispatch`). Minor and patch
+updates are grouped into one PR and automerged only after CI is green
+(`platformAutomerge: false`, so Renovate waits on the checks itself); major
+updates require approval on the dependency dashboard. The job authenticates with
+the `renovate-bot` account token stored as the repo Actions secret
+`RENOVATE_TOKEN`; rotation only requires overwriting that secret (the bot
+password lives in `/root/.gitea-renovate-bot.env` on the host). `minimumReleaseAge`
+is 3 days in `renovate.json` and 60 hours in `pnpm-workspace.yaml`, so neither the
+installer nor the bot picks up a fresh release on day zero. Node/pnpm upgrades
+remain coordinated with Docker and the runner toolchain.
 Obsolete global overrides were removed; a scoped esbuild override remains because
 Drizzle Kit's loader still resolves a vulnerable legacy development-server build.
 The two deprecated esbuild-kit packages remain upstream dependencies of Drizzle