Add rebaseWhen: 'behind-base-branch' to automatically rebase Renovate PRs
when they fall behind main. This fixes CI failures on dependency update PRs
that were created before recent schema changes (device_role_source removal).
Without auto-rebase, Renovate PRs based on old main fail CI because:
- Old code references removed device_role_source field
- New migrations drop the column
- Tests fail with ERROR 42703 (undefined_column)
Now Renovate will automatically rebase PRs to pick up latest changes.
Reviewed-on: graham/towerops-web#111
