Add a weekly Renovate workflow for dependency updates

Runs renovate/renovate against this Gitea instance on the native
deploy runner, opening PRs for outdated Bundler dependencies instead
of relying on manually noticing (as happened with puma/mustermann
earlier).

docs/development.adoc

@@ -98,3 +98,17 @@ Gitea Actions runner: `ruby -c` on every `.rb` file, a `require_relative
 "app"` smoke check that the app loads without error, and `node --check`
 on every file under `public/js/`. There is no test suite yet — these
 are cheap syntax/load checks, not behavioral tests.
+
+`.gitea/workflows/renovate.yml` runs
+https://docs.renovatebot.com[Renovate] (the `renovate/renovate` image)
+weekly (Mondays, also triggerable manually), opening PRs for outdated
+dependencies (Bundler `Gemfile`/`Gemfile.lock`, auto-detected — no
+`renovate.json` needed) against this Gitea instance
+(`RENOVATE_PLATFORM=gitea`). It runs on the native `deploy` runner (see
+`docs/deployment.adoc`) as a one-shot `docker run`, not a persistent
+service. Needs a `RENOVATE_TOKEN` repo secret — a Gitea personal
+access token (*Settings → Applications → Generate New Token*, with
+repository read/write scope) from whichever account should author the
+PRs; `RENOVATE_ONBOARDING=false` skips Renovate's usual first-PR
+"configure me" step and goes straight to dependency update PRs using
+its defaults.