fix(ci): point Dependabot at the pnpm workspace root

The npm entry aimed at /apps/web updated only apps/web/package.json and left
the root pnpm-lock.yaml untouched, so every resulting PR failed CI on
ERR_PNPM_OUTDATED_LOCKFILE — even a postcss patch bump (#69). A pnpm
workspace has one lockfile at the root, so a single npm entry there covers
both apps and keeps the lockfile in step; the root entry produced correct
PRs (#66 updated the manifest and the lockfile together).

Also folds the former root entry's schedule into the single npm entry and
adds an eslint group.

Author: yashranaway

.github/dependabot.yml

@@ -1,17 +1,22 @@
 version: 2
 
 updates:
-  # The Swift package has zero third-party dependencies by design, so there is
-  # nothing to update there — see docs/roadmap/what-is-excellent.md §11.
+  # One npm entry for the whole pnpm workspace. It must point at the root:
+  # apps/web and apps/headless share a single pnpm-lock.yaml there, and an
+  # entry aimed at a workspace member updates only that member's
+  # package.json, leaving the root lockfile stale and every CI job failing
+  # on --frozen-lockfile.
+  #
+  # The Swift package has zero third-party dependencies by design, so there
+  # is nothing to update for it — see docs/roadmap/what-is-excellent.md §11.
   - package-ecosystem: npm
-    directory: /apps/web
+    directory: /
     schedule:
       interval: weekly
       day: monday
     open-pull-requests-limit: 5
     labels:
       - "type:chore"
-      - "area:web"
     groups:
       react:
         patterns: ["react", "react-dom", "@types/react", "@types/react-dom"]
@@ -21,14 +26,8 @@ updates:
         patterns: ["tailwindcss", "@tailwindcss/*"]
       types:
         patterns: ["@types/*"]
-
-  - package-ecosystem: npm
-    directory: /
-    schedule:
-      interval: monthly
-    open-pull-requests-limit: 3
-    labels:
-      - "type:chore"
+      eslint:
+        patterns: ["eslint", "@eslint/*"]
 
   - package-ecosystem: github-actions
     directory: /