chore: import upstream snapshot with attribution

.github/workflows/README.md

@@ -0,0 +1,50 @@
+# GitHub Actions Workflows
+
+This directory contains GitHub Actions workflows for automated development tasks.
+
+## Update NPM Dependencies Workflow
+
+**File**: `update-npm-dependencies.yml`
+
+### Purpose
+Automatically updates NPM dependencies across all package.json files in the project and fixes security vulnerabilities.
+
+### Triggers
+- **Scheduled**: Every Thursday at 08:00 UTC (day after PDM updates)
+- **Manual**: Can be triggered manually via GitHub Actions UI
+- **Workflow Call**: Can be called by other workflows
+
+### What it does
+1. **Security Audit**: Runs `npm audit` to identify security vulnerabilities
+2. **Security Fixes**: Automatically fixes moderate+ severity vulnerabilities with `npm audit fix`
+3. **Dependency Updates**: Updates all dependencies to latest compatible versions with `npm update`
+4. **Testing**: Runs relevant tests to ensure updates don't break functionality
+5. **Pull Request**: Creates automated PR with all changes
+
+### Directories Managed
+- `/` - Main web dependencies (Vite, Bootstrap, etc.)
+- `/tests/ui_tests` - UI test dependencies (Puppeteer)
+
+### Branch Strategy
+- Creates branch: `update-npm-dependencies-{run_number}`
+- Targets: `main` branch
+- Labels: `maintenance`
+- Reviewers: `djpetti,HashedViking,LearningCircuit`
+
+### Security Focus
+- Only auto-fixes moderate+ severity vulnerabilities
+- Preserves compatible version updates (no major version bumps)
+- Runs security audit before and after updates
+- Requires tests to pass before creating PR
+
+### Manual Usage
+You can manually trigger this workflow:
+1. Go to Actions tab in GitHub
+2. Select "Update NPM dependencies"
+3. Click "Run workflow"
+4. Optionally specify custom npm arguments
+
+### Troubleshooting
+- If tests fail, the PR won't be created
+- Check the workflow logs for specific error messages
+- Security issues that can't be auto-fixed will need manual intervention