ci: add Renovate for automated dependency updates

- renovate-bot user created with write access to stack repo
- Weekly schedule (Monday 4am) + manual dispatch
- Auto-merge minor/patch, PR for major versions
- Scans pyproject.toml, compose.yml, Dockerfiles

.gitea/workflows/renovate.yml

@@ -0,0 +1,21 @@
+name: Renovate
+
+on:
+  schedule:
+    - cron: "0 4 * * 1"  # Weekly Monday 4am
+  workflow_dispatch:
+
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    container: ghcr.io/renovatebot/renovate:latest
+    steps:
+      - uses: https://github.com/actions/checkout@v4
+
+      - name: Run Renovate
+        run: renovate
+        env:
+          RENOVATE_CONFIG_FILE: renovate.json
+          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
+          RENOVATE_GIT_AUTHOR: "Renovate Bot <renovate@fhirworx.io>"
+          LOG_LEVEL: "info"

renovate.json

@@ -0,0 +1,24 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended"],
+  "platform": "gitea",
+  "endpoint": "http://git:3000/api/v1",
+  "gitAuthor": "Renovate Bot <renovate@fhirworx.io>",
+  "automerge": false,
+  "labels": ["dependencies"],
+  "packageRules": [
+    {
+      "matchUpdateTypes": ["minor", "patch"],
+      "automerge": true
+    }
+  ],
+  "pip_requirements": {
+    "fileMatch": ["pyproject.toml"]
+  },
+  "docker-compose": {
+    "fileMatch": ["compose.yml"]
+  },
+  "dockerfile": {
+    "fileMatch": ["infra/images/*.Dockerfile"]
+  }
+}