ci: group and format Dependabot updates

[satvik007]

Summary

• combine scheduled npm and GitHub Actions updates into one weekly multi-ecosystem PR
• group security updates per ecosystem, the narrowest split GitHub supports
• apply Prettier to Dependabot changes before lint, tests, and builds
• reproduce and commit formatter changes on the bot branch before merging
• serialize Dependabot merges to avoid concurrent updates racing on main

Validation

• YAML parsed successfully
• Prettier and ESLint passed
• Svelte type-check passed
• Vitest passed (1 test)
• production build passed

Notes

GitHub does not allow security updates to be combined with scheduled version updates or across package ecosystems.