chore(deps): resolve all dependabot alerts via dev-dependency updates (#229)

- npm audit fix across the dev tree (vitest 4.1.x, vite 7.3.x, svelte,
  handlebars, lodash, tar, undici, and friends) - 31 advisories cleared
- override undici to ^6.27.0 under @actions/http-client (no patched 5.x)
- re-resolve bundled npm to 11.18.0, whose vendored undici 6.27.0 fixes
  the last advisory npm audit fix cannot reach
- add .github/dependabot.yml (weekly, grouped npm + github-actions)

Production deps (fuse.js, openai) are unchanged; shipped main.js is
identical.

Author: chhoumann

.github/dependabot.yml

@@ -0,0 +1,23 @@
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    groups:
+      npm-minor-patch:
+        applies-to: version-updates
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+      npm-security:
+        applies-to: security-updates
+        patterns:
+          - "*"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"