chore: add SECURITY.md and Dependabot config (#893)

Document private vulnerability reporting and enable weekly npm/Cargo
dependency update PRs; link CONTRIBUTING to the new security policy.

.github/dependabot.yml

@@ -0,0 +1,22 @@
+# Weekly dependency update PRs for npm (frontend) and Cargo (src-tauri workspace).
+# Review and merge like any other PR; run CI before merging.
+
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+
+  - package-ecosystem: cargo
+    directory: /src-tauri
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies