ci: GitLab-Pipeline - build_embedded + manueller npm-Publish nach rohana (threadnet-call#1)

Registry-Entscheidung evidenzbasiert: das Package ist pnpm-Dependency von
ThreadNet-Webs apps/web, der Lockfile pinnt die Tarball-URL auf rohana -
Registry bleibt dort. Publish-Auth ueber CI-Variable GITEA_NPM_TOKEN statt
lokaler Klartext-.npmrc.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

renovate.json

@@ -0,0 +1,73 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended",
+    "schedule:monthly",
+    ":enableVulnerabilityAlertsWithLabel(security)"
+  ],
+  "addLabels": ["dependencies"],
+  "minimumReleaseAge": "5 days",
+  "packageRules": [
+    {
+      "groupName": "all non-major dependencies",
+      "groupSlug": "all-minor-patch",
+      "matchUpdateTypes": ["minor", "patch"]
+    },
+    {
+      "groupName": "GitHub Actions",
+      "matchDepTypes": ["action"],
+      "pinDigests": true
+    },
+    {
+      "description": "Disable Renovate for packages we want to monitor ourselves",
+      "groupName": "manually updated packages",
+      "matchDepNames": ["matrix-js-sdk"],
+      "enabled": false
+    },
+    {
+      "groupName": "matrix-widget-api",
+      "matchDepNames": ["matrix-widget-api"],
+      "extends": ["schedule:weekly"]
+    },
+    {
+      "groupName": "Compound",
+      "matchPackageNames": ["@vector-im/compound-{/,}**"],
+      "extends": ["schedule:weekly"]
+    },
+    {
+      "groupName": "LiveKit client",
+      "matchDepNames": ["livekit-client"],
+      "extends": ["schedule:weekly"]
+    },
+    {
+      "groupName": "LiveKit components",
+      "matchPackageNames": ["@livekit/components-{/,}**"],
+      "extends": ["schedule:weekly"]
+    },
+    {
+      "groupName": "Vaul",
+      "matchDepNames": ["vaul"],
+      "prHeader": "Please review modals on mobile for visual regressions."
+    },
+    {
+      "groupName": "PostHog",
+      "matchDepNames": ["posthog-js"],
+      "prHeader": "Please ensure that all analytics data is still appropriately sanitized."
+    },
+    {
+      "groupName": "embedded package dependencies",
+      "matchFileNames": ["embedded/**/*"]
+    },
+    {
+      "groupName": "Pnpm",
+      "matchDepNames": ["pnpm"]
+    }
+  ],
+  "semanticCommits": "disabled",
+  "ignoreDeps": ["eslint-plugin-matrix-org"],
+  "vulnerabilityAlerts": {
+    "schedule": ["at any time"],
+    "prHourlyLimit": 0,
+    "minimumReleaseAge": null
+  }
+}