Configure Dependabot to target develop branch (#54)

* fix: resolve 30 CodeQL alerts - Remove unused imports/variables, fix empty excepts, improve file permissions

- Remove unused global variable (PathT) in path_security.py
- Remove abstract method ellipsis statements in base_handler.py
- Remove unused imports: Path from diff.py, struct from ole_handler.py, Any from office_handler.py, io from image_handler.py, os/Any from routes.py, tempfile from test_path_security.py, io/tempfile from test_handlers.py, pytest from test_registry.py, pytest from conftest.py
- Replace empty except blocks with continue statements in office_handler.py, filesystem_handler.py, routes.py
- Fix overly permissive file in test_path_security.py by using mode=0o700 for directory creation
- Fix unused local variables: captured_temp_path in test_path_security.py, useCallback from App.jsx, useCallback from FilePanel.jsx, SortIcon component in FilePanel.jsx

* fix: correct CodeQL resolution defects - Restore Any import, fix continue outside loops, remove unused TypeVar

* ci: trigger CodeQL rescan

* fix: resolve remaining 10 CodeQL alerts - Correct PR #53 merge issues

* chore: configure dependabot to target develop branch for version updates

- Add target-branch: develop to all 3 package ecosystems (pip, npm electron, npm frontend)
- Add rebase-strategy: auto for automatic conflict resolution
- Preserve existing labels for better PR organization
- NOTE: Security updates will still target main (GitHub limitation)
- See docs for details on managing existing open PRs

Author: overwrite00

.github/dependabot.yml

@@ -6,13 +6,26 @@ updates:
     schedule:
       interval: weekly
     open-pull-requests-limit: 5
+    # Route version-update PRs to develop (dev branch); main is release-only.
+    # NOTE: Dependabot *security* updates ignore target-branch and always
+    # target the default branch (main). See README/notes below.
+    target-branch: develop
+    rebase-strategy: auto
+    labels:
+      - dependencies
+      - python
 
   # Node.js (Electron)
   - package-ecosystem: npm
     directory: /electron
     schedule:
       interval: weekly
     open-pull-requests-limit: 5
+    target-branch: develop
+    rebase-strategy: auto
+    labels:
+      - dependencies
+      - javascript
     ignore:
       # tar vulnerabilities - no upstream fix available
       # These are false positives for a desktop app: hardlink traversal/symlink poisoning
@@ -29,3 +42,8 @@ updates:
     schedule:
       interval: weekly
     open-pull-requests-limit: 5
+    target-branch: develop
+    rebase-strategy: auto
+    labels:
+      - dependencies
+      - javascript