feat: Sprint 2 — test coverage, Dependabot, coverage gates, E2E expansion

API Router Integration Tests (43 new tests):
- dashboard-router.test.ts: 11 tests (all 5 queries + RBAC)
- project-router.test.ts: 17 tests (full CRUD + batch ops + RBAC)
- resource-router-crud.test.ts: 15 tests (CRUD + hover card + skill import)
- Fix: mock budget-alerts + cache in existing allocation/timeline tests

E2E Test Suite Expansion (29 new tests, 7 spec files):
- dashboard.spec.ts: widget grid, stat cards, add widget modal
- allocations.spec.ts: list, create modal, filters, column toggle
- estimates.spec.ts: list, wizard steps, navigation
- vacations.spec.ts: self-service, management, team calendar
- staffing.spec.ts: search, suggestions, skill tags
- admin.spec.ts: settings, users, roles, blueprints
- navigation.spec.ts: nav links, sidebar collapse, theme, mobile menu

Coverage Gates:
- api package: 80% lines, 75% branches
- application package: 80% lines, 75% branches (new vitest.config.ts)
- shared package: 70% lines, 65% branches
- CI updated to run per-package vitest --coverage

Dependabot:
- Weekly npm dependency checks with grouped minor+patch
- GitHub Actions version checks
- 10 PR limit for npm, 5 for Actions

Co-Authored-By: claude-flow <ruv@ruv.net>

packages/api/src/__tests__/allocation-router.test.ts

@@ -10,6 +10,14 @@ vi.mock("../sse/event-bus.js", () => ({
   emitAllocationUpdated: vi.fn(),
 }));
 
+vi.mock("../lib/budget-alerts.js", () => ({
+  checkBudgetThresholds: vi.fn(),
+}));
+
+vi.mock("../lib/cache.js", () => ({
+  invalidateDashboardCache: vi.fn(),
+}));
+
 const createCaller = createCallerFactory(allocationRouter);
 
 function createManagerCaller(db: Record<string, unknown>) {