chore(build): Makefile.terraform targets still use the old per-profile layout; Dependabot doesn't cover docker-compose #1572

What happens

Makefile.terraform's validate, state-list and state-show targets still build terraform/environments/<provider>/<profile>, a per-profile directory layout that no longer exists. The environments are flat per-provider roots (terraform/environments/<provider>) with -var-file and -backend-config per profile. #1566 moved scripts/tf-deploy.sh to the flat layout but left these Makefile targets, so they fail with a missing directory.

Separately, Dependabot doesn't cover docker-compose.yml, so the image digests #1566 pinned (nginx, pgadmin4) won't be bumped automatically.

Proposal

• Point the three Makefile targets at terraform/environments/<provider> with the profile's tfvars and backend file, the same way scripts/tf-deploy.sh does after chore(ci): scan the AWS root in the trivy hook, pin Terraform in one file, fix tf-deploy.sh and make complexity (#349) #1566, and give each profile its own TF_DATA_DIR.
• Add a docker-compose entry to .github/dependabot.yml for the repo root.

Acceptance criteria

• make -n -f Makefile.terraform validate PROVIDER=aws PROFILE=dev (and the state targets) reference only existing paths; a gate test covers it.
• Dependabot config lists the docker-compose ecosystem.

Refs #349, #1566.

Filed by IAmJSD's agent at IAmJSD's request (acting owner while the maintainers are away).