chore: extend Dependabot (gomod, npm), check the go-httpbin port, note the v tag convention

- Dependabot now also updates Go modules and npm packages (grouped, weekly), not just actions.
- check-default-ports also verifies the go-httpbin proxy port (PROXY_TARGET_PORT, 8090).
- Document the 'vX.Y.Z' tag convention in the CI trigger comments (bare X.Y.Z still works).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: gwleclerc

.github/dependabot.yml

@@ -10,3 +10,23 @@ updates:
       github-actions:
         patterns:
           - "*"
+
+  # Go module dependencies.
+  - package-ecosystem: gomod
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      gomod:
+        patterns:
+          - "*"
+
+  # Frontend (npm) dependencies.
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      npm:
+        patterns:
+          - "*"

.github/workflows/main.yml

@@ -3,11 +3,12 @@ on:
   push:
     branches:
       - main
-    # Release flavor is derived from the tag suffix in the deploy job:
+    # Release flavor is derived from the tag suffix in the deploy job. Convention: prefix tags
+    # with "v" (bare X.Y.Z is still accepted for backward compatibility).
     tags:
-      - '*.*.*' # stable semver (e.g. 1.2.3): published and marked "Latest"
-      - '*-preview' # pre-release (e.g. 1.2.3-preview): published, never "Latest"
-      - '*-draft' # draft (e.g. 1.2.3-draft): unpublished for review, never "Latest"
+      - '*.*.*' # stable semver (e.g. v1.2.3): published and marked "Latest"
+      - '*-preview' # pre-release (e.g. v1.2.3-preview): published, never "Latest"
+      - '*-draft' # draft (e.g. v1.2.3-draft): unpublished for review, never "Latest"
   pull_request:
     branches:
       - main

Makefile

@@ -174,6 +174,7 @@ smoke-docker:
 check-default-ports:
 	@lsof -i:8080 > /dev/null && (echo "Port 8080 already in use"; exit 1) || true
 	@lsof -i:8081 > /dev/null && (echo "Port 8081 already in use"; exit 1) || true
+	@lsof -i:$(PROXY_TARGET_PORT) > /dev/null && (echo "Port $(PROXY_TARGET_PORT) (go-httpbin) already in use"; exit 1) || true
 
 .PHONY: optimize
 optimize: