Chore: reduce Dependabot update noise

[Artsen]

Summary

• Changes npm Dependabot version-update checks from weekly to monthly.
• Lowers npm version-update PR limit from 5 to 2.
• Keeps npm minor and patch updates grouped together.
• Ignores automatic npm semver-major version updates.
• Keeps GitHub Actions checks monthly, groups all Actions updates together, and lowers the Actions version-update PR limit to 1.

Scope boundaries

• Dependabot configuration only.
• No application code changes.
• No dependency updates.
• No auto-merge configuration added.
• Security updates remain available; open-pull-requests-limit only changes version-update PR limits.

Verification

• Confirmed syntax against GitHub Dependabot options reference.
• YAML parsed by Prettier during npm run format:check.
• npm run format:check passed.
• git diff --check passed.