dependabot: move major-version exclusions into the config

Comment-based ignores did not survive the last config change, and the
SQLAlchemy rule only blocked majors while 1.4 (the 2.0 transition
release) slipped into the python group. Hold SQLAlchemy <1.4, alembic
<1.11, cachetools majors (mru_cache removed in 6), and the npm majors
that each need a migration branch: maplibre-gl 6, react-dropzone 15+,
React 19, TypeScript 6+, Mantine 9.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

.github/dependabot.yml

@@ -8,12 +8,15 @@ updates:
     target-branch: "master"
     open-pull-requests-limit: 5
     ignore:
-      # alembic >=1.11 requires SQLAlchemy 2; requirements.txt pins SQLAlchemy 1.3.
-      # Grouped PRs containing it fail to install, so hold alembic until the
-      # SQLAlchemy 2 migration lands.
+      # SQLAlchemy 1.4 is the 2.0 transition release and is not a drop-in
+      # change for this codebase; alembic >=1.11 requires SQLAlchemy 2.
+      # Hold both until the SQLAlchemy 2 migration lands.
+      - dependency-name: "SQLAlchemy"
+        versions: [">=1.4"]
       - dependency-name: "alembic"
         versions: [">=1.11"]
-      - dependency-name: "SQLAlchemy"
+      # cachetools 6 removed cachetools.func.mru_cache, still used by modules/zim.
+      - dependency-name: "cachetools"
         update-types: ["version-update:semver-major"]
     groups:
       python-dependencies:
@@ -45,6 +48,29 @@ updates:
       interval: "monthly"
     target-branch: "master"
     open-pull-requests-limit: 5
+    ignore:
+      # Major upgrades below need their own migration branch, not a bump PR.
+      # maplibre-gl 6: /map build depends on pinned babel/terser handling.
+      - dependency-name: "maplibre-gl"
+        versions: [">=6"]
+      # react-dropzone 15+ changed the accept API; 20 requires Node >=22.
+      - dependency-name: "react-dropzone"
+        versions: [">=15"]
+      # React 19: @react-three/fiber 8 pins react <19.
+      - dependency-name: "react"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "react-dom"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "@types/react"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "@types/react-dom"
+        update-types: ["version-update:semver-major"]
+      # TypeScript 6+/7 breaks the react-scripts toolchain.
+      - dependency-name: "typescript"
+        versions: [">=6"]
+      # Mantine 9: all @mantine packages move together with app code changes.
+      - dependency-name: "@mantine/*"
+        update-types: ["version-update:semver-major"]
     groups:
       npm-dependencies:
         patterns: