chore(renovate): automerge patch and digest updates for selected images

[anatolinicolae]

Summary

Adds a Renovate rule that automerges patch, digest and pinDigest updates for 10 Docker images. Minor and major bumps still open a PR for review. n8n and its runners are also grouped into one PR so their versions stay in step.

• cloudflare/cloudflared
• ghcr.io/thundersquared/authentik
• ghcr.io/tbphp/gpt-load
• valkey/valkey
• ghcr.io/thundersquared/twentycrm
• ghcr.io/maathimself/mailflow-frontend
• ghcr.io/maathimself/mailflow-backend
• ghcr.io/tailscale/tailscale
• ghcr.io/thundersquared/n8n
• n8nio/runners

Notes

• A merge to main deploys to the hosts, and CI doesn't start the new image. The rule's description says this and says to keep headscale/headscale out.
• Mailflow (frontend + backend) and n8n (n8n + runners) each come as one grouped PR. A grouped PR automerges only when every update in it is patch or digest.
• Requires "Allow auto-merge" in the repository settings, because Renovate uses GitHub's native auto-merge.
• renovate-config-validator --strict passes.

Replaces #526.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Pull request is closed - (🔄 Check again to try again)

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}