Point Dependabot npm version updates at the repo root instead of the missing /spa #4979

Problem

.github/dependabot.yml has a single npm entry, and its directory is "/spa". That directory no longer exists. The root package.json and package-lock.json sit at /, so Dependabot never opens version-update PRs for the root project.

This doesn't affect security. Dependabot alerts and security-update PRs come from the dependency graph, not from this file, and they still cover the root lockfile. It came up while reviewing #4978.

Change

• Point the npm entry at directory: "/".
• Before turning it on, decide on the schedule and the open-PR limit. The entry runs daily with open-pull-requests-limit: 50, which may be noisy for the root project once it starts working. Grouping (groups:) or a weekly interval are options.
• Decide whether the other manifests should get version-update entries too: /files and /.gitlab (npm), /analytics (uv), and GitHub Actions.

Out of scope

• Security alerts and security-update PRs, which already work.

Done when

• .github/dependabot.yml points npm version updates at /, with the schedule and limit agreed above.
• Dependabot's update job for the root project runs without a "directory not found" error (Insights → Dependency graph → Dependabot), and opens or lists version-update PRs for the root package.json.