Renovate for all repos, with a shared preset

Renovate ran from the iac repo for iac only. Run it from here for every
repo that should get version bump PRs, with the rules they share in
default.json (local>asxpi/renovate): bundler held at nixpkgs' 2.7.2,
Postgres majors flagged as migrations, action bumps grouped.

Repos without a renovate.json get an onboarding PR first, so nothing
changes in a repo until its config is merged.

Assisted-by: Claude:opus-5-5

default.json

@@ -0,0 +1,39 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "description": "Shared Renovate rules for asxpi/* and czsk/* (extend with local>asxpi/renovate)",
+  "extends": ["config:recommended", ":disableDependencyDashboard"],
+  "timezone": "Europe/Helsinki",
+  "labels": ["dependencies"],
+  "prHourlyLimit": 0,
+  "prConcurrentLimit": 10,
+  "commitMessagePrefix": "deps:",
+  "constraints": {
+    "bundler": "2.7.2"
+  },
+  "packageRules": [
+    {
+      "description": "Keep lock files on the bundler nixpkgs ships (BUNDLED WITH 2.7.2); a newer one makes CI install no gems",
+      "matchManagers": ["bundler"],
+      "matchPackageNames": ["bundler"],
+      "enabled": false
+    },
+    {
+      "description": "Postgres majors need a dump and restore: open the PR, never let it look routine",
+      "matchPackageNames": ["postgres", "docker.io/library/postgres"],
+      "matchUpdateTypes": ["major"],
+      "labels": ["dependencies", "needs-migration"],
+      "prBodyNotes": ["A Postgres major upgrade needs pg_dumpall + restore into a fresh volume (see storage/README.md). Do not merge as a routine bump."]
+    },
+    {
+      "description": "Group the patch and minor bumps of a repo's GitHub/Forgejo actions",
+      "matchManagers": ["github-actions"],
+      "matchUpdateTypes": ["minor", "patch"],
+      "groupName": "CI actions"
+    },
+    {
+      "description": "Renovate itself releases daily; once a month is enough",
+      "matchPackageNames": ["ghcr.io/renovatebot/renovate"],
+      "schedule": ["* * 1 * *"]
+    }
+  ]
+}