deps: land Sept Dependabot bumps (supersedes #22/#23/#24) + quieter dependabot.yml

[devin-ai-integration]

Summary

Manual landing of this week's three grouped Dependabot PRs, minus the two bumps we can't take:

package	from → to	where
openai	7.13.0 → 7.17.0	root, server
zod	4.6.0 → 4.6.5	server
prettier	3.9.6 → 3.9.7	server
@types/node	22.20.2 → 22.20.4 (not 26.x)	root, server
react, react-dom	19.2.8 → 19.3.0	client
@types/react	19.2.18 → 19.3.0	client
typescript	stays 6.0.3 (not 7.0.2)	all

Skipped on purpose: typescript 7 (typescript-eslint 8.70 peer range is <6.1.0 — same blocker as #15) and @types/node 26 (runtime is pinned to Node 22 via engines/.node-version/vercel.json; types should track it).

.github/dependabot.yml changes so these two don't get re-proposed every week and the notification volume drops:

- interval: weekly            → monthly (both entries)
- directory: "/server" entry  → removed: `server/` is an npm workspace member with no own lockfile,
                                 so the root entry already updates it (#23 contained the /server bumps;
                                 #22 was a duplicate that only touched server/package.json)
+ ignore: typescript semver-major            (root + client)
+ ignore: @types/node semver-major           (root)

Security alerts are unaffected by the cadence — Dependabot security updates (if enabled in repo settings) still open a PR immediately.

Closes #22, #23, #24.

Testing

Same steps as CI, locally on Node 22.23.2: server tsc --noEmit + eslint . (0 errors), client tsc --noEmit, client + server build, both serverless handlers load, production smoke (/api/health, SPA served, invalid grade → 400, mocked generation → 200). npm audit: 0 vulnerabilities in all workspaces.

Link to Devin session: https://app.devin.ai/sessions/3c661e4bb5b54f949e5d3098efe8934a
Open in Devin Desktop: https://app.devin.ai/desktop/session/3c661e4bb5b54f949e5d3098efe8934a?variant=devin
Requested by: @southbayjay

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Regression-tested this deps-only bump locally (Node 22; dev Vite 8 + Express and production NODE_ENV=production node server/dist/index.js; OpenAI mocked via OPENAI_BASE_URL, fixture strings prefixed MOCKLLM) — golden path all clear.

• Installed: openai@7.17.0, zod@4.6.5, react/react-dom/@types/react 19.3.0, @types/node@22.20.4, prettier@3.9.7; npm audit → 0 vulnerabilities (root + client)
• vite build + server tsc clean; dev and prod boot; /api/health 200
• Page loads with zero console errors in dev and prod (React 19.3)
• Light mode: native grade/topic selects still boxed (1px gray-300, white bg, rounded); primary button #0284c7. Dark toggle → html.dark, gray-900 page, gray-700 selects
• Mocked generation works end-to-end in dev (3rd Grade/Science) and prod (5th Grade/Geography): spinner → full worksheet; POST /api/generate-worksheet → 200, mock upstream hit (openai 7.17 client)
• Invalid grade (test-injected option) → server 400, red banner Invalid request data (zod 4.6.5 validation path)

Error banner, dark mode, production

Invalid input → banner	Dark mode

Real-model generation not exercised here (mocked upstream; verified separately with openai 7). Cloudflare/Vercel handlers not re-tested (no changes).