chore(deps): group routine Dependabot updates

[TheRealAgentK]

Summary

• retain the monthly Dependabot schedule
• wait 7 days before proposing routine npm releases
• group root development dependency patch/minor updates
• group patch/minor updates for the example
• leave root production and all major updates as individual PRs
• leave GitHub Actions update behavior unchanged

Dependabot cooldowns apply only to version updates, not security updates. Every group is also explicitly scoped to version-updates, so security updates remain immediate and separate. Major updates use the same 7-day cooldown but remain individual PRs for manual review.

Verification

• parsed .github/dependabot.yml as YAML
• verified both npm blocks retain schedule.interval: monthly
• verified both npm blocks define a 7-day cooldown and version-update-only grouping policy
• git diff --check

[QuantumNightmare]

👍