chore: configure Dependabot and trim the licence section

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: KiaroSama

.github/dependabot.yml

@@ -0,0 +1,43 @@
+# Nothing was watching this project's dependencies. There was no file here at all,
+# so Dependabot had no version updates to run - and a fork starts with Dependabot
+# ALERTS switched off by default, which is why no security PR ever appeared either.
+# The alerts toggle is repository state, not config; it lives in Settings ->
+# Advanced Security and had to be turned on separately from this file.
+version: 2
+
+updates:
+  # uv, not pip: uv.lock is the source of truth here and `uv` updates it together
+  # with pyproject.toml. A `pip` entry would report the same dependencies a second
+  # time from requirements.txt and open competing pull requests for one bump.
+  #
+  # requirements.txt is left to the test that already guards it: every dependency
+  # is declared as a `>=` floor, so a lock refresh does not move the declared
+  # constraints, and tests/test_packaging.py fails loudly if the two ever diverge.
+  - package-ecosystem: "uv"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    open-pull-requests-limit: 5
+    groups:
+      # Grouped so a quiet week is one pull request rather than nine. Majors stay
+      # out of every group on purpose: they are the ones that need release notes
+      # read and a migration considered, which cannot be done in bulk.
+      python-minor-and-patch:
+        update-types: ["minor", "patch"]
+
+  # Four workflows run on every push, with credentials and repository write scope
+  # between them. An action is a dependency like any other.
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    groups:
+      actions-minor-and-patch:
+        update-types: ["minor", "patch"]
+
+  # The Dockerfile's base image. Ungrouped: a base image bump changes the whole
+  # runtime underneath the application, so it is never routine.
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "daily"

README.md

@@ -968,13 +968,8 @@ If this project helps you, donations are appreciated.
 
 ## Licence
 
-GNU General Public License v3.0 or later. See [LICENSE](LICENSE) for the licence text and [NOTICE](NOTICE) for the copyright and prior-work attribution.
-
-Portions originated in an Apache-2.0 project (below), and that licence permits their
-inclusion in a GPLv3 work — the Apache Software Foundation states it plainly: *"Apache 2
-software can therefore be included in GPLv3 projects."* The compatibility runs one way
-only, so the program as a whole is GPLv3 while the prior Apache-2.0 grant continues to
-cover what it originally covered.
+GNU General Public License v3.0 or later. See [LICENSE](LICENSE) for the licence text and
+[NOTICE](NOTICE) for the copyright and prior-work attribution.
 
 ## Built on
 
@@ -983,4 +978,4 @@ cover what it originally covered.
 
 Portions of this codebase originated in [telegram-mcp](https://github.com/chigwell/telegram-mcp)
 by chigwell and l1v0n1, under the Apache License 2.0, and have been substantially modified and
-extended since. That attribution is recorded in [LICENSE](LICENSE).
+extended since. That attribution is recorded in [NOTICE](NOTICE).