chore: resolve all dependabot PRs, pin actions to latest SHA, add root docs

[BankkRoll]

Resolves all open dependabot PRs and adds missing root-level repo files. No new features — purely dependency hygiene and docs.

Resolves dependabot PRs: #73, #70, #68, #46, #45, #44, #43, #42, #41, #39, #37, #35

---

Dependency updates

npm packages

• vite 5.4.16 → 5.4.21 — security patches for server.fs access controls (Bump vite from 5.4.16 to 5.4.21 #37)
• ipx 3.0.1 → 3.1.1 — path traversal fix, svgo v4 + sharp v0.34 internally (Bump ipx from 3.0.1 to 3.1.1 #35)
• svgo 3.3.2 → 3.3.3 (transitive via ipx) — crash fix on DTD comments (Bump svgo from 3.3.2 to 3.3.3 in /census/website/ipx #41)
• picomatch 2.3.1 → 2.3.2 (transitive via ipx) — ReDoS + method injection CVE fixes (Bump picomatch from 2.3.1 to 2.3.2 in /census/website/ipx #45)
• node-forge 1.3.1 → 1.4.0 (transitive via ipx) — four HIGH CVEs: RSA forgery, Ed25519 non-canonical sigs, X.509 chain validation (Bump node-forge from 1.3.1 to 1.4.0 in /census/website/ipx #44)
• yauzl 3.2.0 → 3.2.1 — crash on malformed ZIP files (Bump yauzl from 3.2.0 to 3.2.1 #42)
• react-router 6.28.1 → 6.30.4 — XSS via open redirect fix in 6.30.3 (Bump react-router from 6.28.1 to 6.30.4 #70)
• wrangler 4.6.0 → 4.59.1 — minor releases within v4 (Bump wrangler from 4.6.0 to 4.59.1 #39)
• drizzle-orm 0.33.0 → 0.45.2 + drizzle-kit 0.24 → 0.31 (Bump drizzle-orm from 0.33.0 to 0.45.2 #46)
• fastify 4.29.0 → 5.8.3 + @fastify/cors 9 → 10 + @fastify/websocket 10 → 11 (Bump fastify from 4.29.0 to 5.8.3 #43)

GitHub Actions (resolves #68, #73)

• cloudflare/wrangler-action v3.15.0 → v4.0.0 (pinned SHA)
• actions/checkout v6.0.2 → v7.0.0 (Node 16 → Node 20)
• pnpm/action-setup v6.0.8 → v6.0.9
• docker/setup-buildx-action v4.0.0 → v4.2.0
• docker/login-action v4.1.0 → v4.3.0
• docker/metadata-action v6.0.0 → v6.2.0
• docker/build-push-action v7.1.0 → v7.3.0
• pulumi/auth-actions v1.0.1 → v2.1.0
• getsentry/action-release v3.6.0 → v3.7.0
• All actions pinned to exact commit SHA

---

Code changes required by upgrades

drizzle-orm 0.36+ (part of the 0.33→0.45 range):

1. pgTable() third-arg callback must return an array instead of an object — updated all 12 schema files in census/api/src/db/schema/
2. drizzle(client, options) two-arg form replaced with drizzle({ client, ...options }) — updated census/api/src/db/db.ts

fastify v5: server.listen() no longer accepts a callback — converted to await server.listen() in census/api/src/index.ts

---

Docs

• Added README.md at repo root (monorepo structure, tech stack, local setup, deployment overview)
• Added CONTRIBUTING.md, SECURITY.md, LICENSE

[MattIPv4]

👀 Thanks for doing this, but I'm not keen on accepting dependency changes from external contributors. We have Dependabot configured to handle updating our dependencies.

I'd also ask that you keep PRs relatively atomic and focused on a single change -- adding docs should be done separately (and you're welcome to still do that) from other changes like changing dependencies.

[BankkRoll]

👀 Thanks for doing this, but I'm not keen on accepting dependency changes from external contributors. We have Dependabot configured to handle updating our dependencies.

I'd also ask that you keep PRs relatively atomic and focused on a single change -- adding docs should be done separately (and you're welcome to still do that) from other changes like changing dependencies.

Thanks, I understand. You have many with CVE's so would get them updated then. feel free to check my github. Full-stack developer and Whitehat.

[MattIPv4]

👍 I'm sure we'll get the Dependabot updates merged in good time. I don't think any of the CVEs against the dependencies pose an actual risk to us, but if you discover something, please follow our existing security policy to report it.

[BankkRoll]

No worries, yeah most are dev tooling and certs/signatures but no untrusted chains or RSA sigs being verified in the site. Will report if i ever come a crossed some thanks!