deps: bump React Native samples + drop dependabot manual-review for RN

[ksroda-sa]

Summary

Consolidated React Native dep bump across both samples, plus removal of the dependabot manual-review exception now that RN iOS CI coverage (#163) catches the iOS-side regressions that exception was designed to prevent.

Bumps (login-pkce + token-refresh)

• react-native 0.85.2 → 0.85.3 (token-refresh catches up)
• @react-native/babel-preset 0.85.2 → 0.85.3
• @react-native/jest-preset 0.85.2 → 0.85.3
• @react-native/metro-config 0.85.2 → 0.85.3
• @react-native/typescript-config 0.85.2 → 0.85.3 (login-pkce catches up)
• babel-jest 30.3.0 → 30.4.1
• jest 30.3.0 → 30.4.2
• typescript 5.9.3 → 6.0.3

react and react-test-renderer stay at 19.2.3 — RN 0.85.3's bundled renderer has the React version hard-baked at 19.2.3 with an exact-equality check that throws at runtime against any other patch. There is no stable RN release yet that bundles a newer React-compatible renderer (0.86 is still RC/nightly).

token-refresh/ios/Podfile.lock regenerated to track the RN 0.85.3 bump (full pod reinstall).

Dependabot exception removal

• .github/dependabot.yml — dropped the manual-review label and obsolete comment block.
• .github/workflows/dependabot-auto-merge.yml — removed the samples/react-native/* directory exclusion; comment updated to reflect that test-ios.yml's RN iOS coverage now catches what manual review used to.

Future RN dep bumps will auto-merge on patch + minor updates if CI is green — same flow as the other frameworks.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR consolidates dependency bumps across the React Native samples (login-pkce + token-refresh) and removes the Dependabot “manual-review” exception for React Native now that RN iOS builds are covered in CI (per #163), enabling auto-merge for patch/minor updates when CI is green.

Changes:

• Bumped React Native-related packages (RN 0.85.2 → 0.85.3 where applicable) plus Jest and TypeScript across both RN samples.
• Regenerated token-refresh/ios/Podfile.lock to reflect the RN bump.
• Removed the React Native exclusion and “manual-review” labeling from Dependabot config/auto-merge workflow.

Reviewed changes

Copilot reviewed 5 out of 9 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
scripts/package.json	Bumps @types/node to align scripts toolchain with updated lockfile.
scripts/yarn.lock	Updates lock entries for @types/node and transitive undici-types.
samples/react-native/login-pkce/package.json	Bumps RN-related dev tooling plus Jest/TypeScript versions for the sample.
samples/react-native/login-pkce/yarn.lock	Updates resolved dependency graph for the bumped RN/Jest/TypeScript packages.
samples/react-native/token-refresh/package.json	Bumps RN/Jest/TypeScript versions to match the consolidated RN sample baseline.
samples/react-native/token-refresh/yarn.lock	Updates resolved dependency graph for the bumped RN/Jest/TypeScript packages.
samples/react-native/token-refresh/ios/Podfile.lock	Updates CocoaPods lockfile after RN upgrade / pod reinstall.
.github/workflows/dependabot-auto-merge.yml	Removes RN directory exclusion so patch/minor Dependabot PRs can be approved/auto-merged.
.github/dependabot.yml	Drops the manual-review label from the RN npm update entry (now consistent with other ecosystems).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.