chore(deps): add 7-day cooldown to dependabot npm updates

Supply-chain defense against compromised npm releases. Recent attacks
(typo-squat, account-takeover, post-install scripts) are typically
discovered and yanked within hours-to-days; waiting on a registry
cool-down before auto-PR gives the community time to react before we
ingest the package.

Config (applied to all 3 npm ecosystems — root, packages/core,
packages/mantine):

- default-days:      7  (general cooldown for any version)
- semver-minor-days: 7  (minor bumps: full week)
- semver-patch-days: 3  (patch bumps: smaller blast radius)

GitHub Actions ecosystem intentionally NOT cooldowned — actions are
GitHub-verified and majors are already blocked by the ignore policy.

Important: security updates BYPASS cooldown (documented in GitHub
dependabot config docs). CVE-driven PRs continue to land immediately.
This delays only proactive version-update PRs.

Modeled after Renovate's `stabilityDays` and common large-org practice.

Author: AIEPhoenix

.github/dependabot.yml

@@ -24,6 +24,14 @@ updates:
       time: '09:00'
       timezone: Asia/Shanghai
     open-pull-requests-limit: 5
+    cooldown:
+      # Supply-chain defense: don't auto-PR versions that haven't existed
+      # on the registry for at least this many days. Gives the community
+      # time to discover and yank compromised releases before we ingest
+      # them. Security updates BYPASS cooldown (so CVE fixes stay fast).
+      default-days: 7
+      semver-minor-days: 7
+      semver-patch-days: 3
     labels:
       - dependencies
     ignore:
@@ -61,6 +69,10 @@ updates:
       time: '09:00'
       timezone: Asia/Shanghai
     open-pull-requests-limit: 5
+    cooldown:
+      default-days: 7
+      semver-minor-days: 7
+      semver-patch-days: 3
     labels:
       - dependencies
       - 'scope:core'
@@ -99,6 +111,10 @@ updates:
       time: '09:00'
       timezone: Asia/Shanghai
     open-pull-requests-limit: 5
+    cooldown:
+      default-days: 7
+      semver-minor-days: 7
+      semver-patch-days: 3
     labels:
       - dependencies
       - 'scope:mantine'