Dependabot 改月度更新并按用途分组

原本每周跑一次会刷很多零碎 PR，看着烦。改成每月一次，并把第三方 AI 服务、本地模型、网络栈拆成几组聚一起，每组出一个 PR 就行。被锁住的 torch/numpy/websockets 几个直接忽略掉，免得它推升级 PR 进来。

.github/dependabot.yml

@@ -3,4 +3,39 @@ updates:
   - package-ecosystem: pip
     directory: /main/xiaozhi-server
     schedule:
-      interval: weekly
+      interval: monthly
+    open-pull-requests-limit: 5
+    groups:
+      ai-services:
+        patterns:
+          - "openai*"
+          - "google-generativeai"
+          - "dashscope"
+          - "baidu-aip"
+          - "cozepy"
+          - "markitdown"
+          - "mem0ai"
+          - "powermem"
+      ai-models:
+        patterns:
+          - "funasr"
+          - "vosk"
+          - "silero_vad"
+          - "opuslib_next"
+          - "sherpa_onnx"
+          - "modelscope"
+      web-stack:
+        patterns:
+          - "httpx"
+          - "aiohttp"
+          - "aiohttp_cors"
+          - "requests"
+          - "pysocks"
+      everything-else:
+        patterns:
+          - "*"
+    ignore:
+      - dependency-name: "torch"
+      - dependency-name: "torchaudio"
+      - dependency-name: "numpy"
+      - dependency-name: "websockets"