ci: expand Dependabot beyond github-actions (npm + pub)

[nandal]

Background

.github/dependabot.yml currently updates only github-actions. The npm trees and the Flutter app get no automated security or version bumps — exactly the dependencies most likely to ship a CVE.

The task

Extend dependabot.yml with update entries for:

• npm — three directories: /landing, /landing/functions, /landing/firestore-tests
• pub (Dart/Flutter) — /app

For each: schedule: weekly, the dependencies label, and a sensible commit-message.prefix (chore or build). Group updates per ecosystem to avoid PR spam (groups: with a wildcard pattern).

Acceptance criteria

• dependabot.yml is valid (GitHub's Dependabot tab shows no config error).
• Dependabot opens grouped PRs for the new ecosystems.
• The existing github-actions entry and the SHA-pin rationale comment are preserved.

Why this is a good first issue

A single, well-scoped config file. No code, immediate security value, and a gentle introduction to our CI/supply-chain setup. Pointer: the comment at the top of the current dependabot.yml.

[wrokin]

🤖 wrokin triage

Expand Dependabot configuration to include npm and pub ecosystems for automated dependency updates, improving supply-chain security.

Suggested priority: medium
Labels applied: enhancement, dependencies, good first issue
Possible duplicate: no

_{Model: deepseek/deepseek-v4-pro · your key, your model (BYOK)}