chore: tighten dependabot grouping and node baseline

.github/dependabot.yml

@@ -9,9 +9,40 @@ updates:
       timezone: Asia/Shanghai
     open-pull-requests-limit: 10
     groups:
+      drizzle-risk:
+        patterns:
+          - "drizzle-orm"
+          - "drizzle-kit"
+      build-tooling:
+        patterns:
+          - "vite"
+          - "@vitejs/plugin-react"
+          - "vitest"
+          - "tsx"
+          - "typescript"
+      routing:
+        patterns:
+          - "react-router-dom"
+      runtime-http:
+        patterns:
+          - "undici"
+      node-runtime-sensitive:
+        patterns:
+          - "cross-env"
       minor-and-patch:
         patterns:
           - "*"
+        exclude-patterns:
+          - "drizzle-orm"
+          - "drizzle-kit"
+          - "vite"
+          - "@vitejs/plugin-react"
+          - "vitest"
+          - "tsx"
+          - "typescript"
+          - "react-router-dom"
+          - "undici"
+          - "cross-env"
         update-types:
           - minor
           - patch
@@ -19,6 +50,15 @@ updates:
         dependency-type: development
         patterns:
           - "*"
+        exclude-patterns:
+          - "drizzle-kit"
+          - "vite"
+          - "@vitejs/plugin-react"
+          - "vitest"
+          - "tsx"
+          - "typescript"
+          - "react-router-dom"
+          - "cross-env"
 
   - package-ecosystem: github-actions
     directory: /

.nvmrc

@@ -0,0 +1 @@
+20.19.0

package.json

@@ -21,6 +21,9 @@
     "url": "git+https://github.com/cita-777/metapi.git"
   },
   "license": "MIT",
+  "engines": {
+    "node": "^20.19.0 || >=22.12.0"
+  },
   "type": "module",
   "scripts": {
     "dev:server": "tsx scripts/dev/run-server.ts --watch",