feat(renovate): add self-hosted Renovate config and Gitea Actions workflow

Run the pinned renovate/renovate image on the host runner every weekday at
04:17 (plus workflow_dispatch) against the gitea platform, authenticating with
the renovate-bot RENOVATE_TOKEN Actions secret. Minor and patch updates are
grouped and automerged only after CI passes; majors wait for dashboard
approval. Document the bot, secret rotation and the minimumReleaseAge policy in
the error-centre runbook.

renovate.json

@@ -0,0 +1,37 @@
+{
+	"$schema": "https://docs.renovatebot.com/renovate-schema.json",
+	"extends": [
+		"config:recommended",
+		":timezone(Europe/Amsterdam)",
+		":semanticCommits",
+		"workarounds:all"
+	],
+	"labels": ["dependencies"],
+	"dependencyDashboard": true,
+	"prConcurrentLimit": 5,
+	"prHourlyLimit": 3,
+	"minimumReleaseAge": "3 days",
+	"lockFileMaintenance": {
+		"enabled": true
+	},
+	"packageRules": [
+		{
+			"description": "Minor en patch: één groeps-PR, automerge pas na groene CI",
+			"matchUpdateTypes": ["minor", "patch", "pin", "digest"],
+			"groupName": "all non-major dependencies",
+			"automerge": true,
+			"platformAutomerge": false
+		},
+		{
+			"description": "Major updates vragen goedkeuring via het dependency-dashboard",
+			"matchUpdateTypes": ["major"],
+			"labels": ["major"],
+			"dependencyDashboardApproval": true
+		},
+		{
+			"description": "Docker-compose draait op :latest; geen digest-pin-ruis",
+			"matchManagers": ["docker-compose"],
+			"pinDigests": false
+		}
+	]
+}