ci: extend dependabot to the website and the Windows client

[z33b0t]

dependabot.yml covered github-actions only. Adds npm (/www) and nuget (/clients/windows), weekly, minor+patch grouped into one PR per ecosystem with majors arriving individually, open-pull-requests-limit: 3.

pip is deliberately left out.requirements.txt carries >= floors, so there is no pinned version for Dependabot to bump — the entry would sit there doing nothing. #10 (locking the Python deps) is the prerequisite, and the pip entry belongs in whichever change lands the lockfile. I put that reasoning in the file so the gap reads as a decision, not an oversight. Swift/SPM isn't supported by Dependabot at all, so clients/mac stays unmanaged — matching what the issue says.

The npm entry carries a comment pointing at the overrides block in www/package.json, since a next bump that finally ships patched postcss/sharp is the signal to drop an override rather than keep it — and brace-expansion is intentionally not overridden there.

Config is YAML-valid and matches the documented schema (patterns defaults to * when a group specifies only update-types). Dependabot won't act on it until it's on the default branch, so the real proof is the first scheduled run after merge.

Note the interaction flagged in #21: if required status checks land, Dependabot PRs need a path through CI that doesn't need a human on every patch bump.

Closes#8

[z33b0t]

@z33b0t ready to merge.

6 checks green (CodeQL only — .github/dependabot.yml isn't in any workflow's path filter, so nothing else was triggered; that's expected rather than a gap).

Config is YAML-valid and schema-correct, but note Dependabot won't act on it until it's on the default branch, so the real proof is the first weekly run after merge. Worth glancing at the PRs it opens — particularly the npm one against the overrides block in www/package.json.

pip is deliberately still absent (needs #10 first); reasoning is in the file and the PR body.