Review and improve Dependabot update strategy

[kylymo]

Parent issue

Part of #885 — Update app's GitHub Apps and automation

Objective

Review and improve the Dependabot update strategy for this pnpm-based repository.

Evidence

• .github/dependabot.yml uses the npm ecosystem while the project uses pnpm and a committed pnpm-lock.yaml.
• Patch, minor, and major updates are grouped together into one all-dependencies group.
• Recent large grouped Dependabot PRs contain more than 40 updates, increasing review and rollback risk.

Scope

• Validate Dependabot behavior against the pnpm lockfile.
• Decide whether major updates should be separated from patch/minor updates.
• Review open Dependabot PRs and stale/duplicated update patterns.
• Document the chosen grouping and review policy.

Acceptance criteria

• Dependabot configuration is confirmed compatible with the package manager and lockfile.
• Major updates have an intentional review strategy.
• Grouping reduces noise without hiding risky upgrades.
• The policy is documented in the repository.

Out of scope

Applying a broad dependency upgrade batch in this issue.