ci(SAL-1382): configure dependabot auth for private npm registry

[salkhwlani]

What kind of change does this PR introduce? (Bug fix, feature, docs update, ...)

• change

What is the current behaviour? (You can also link to an open issue here)

• Dependabot runs fail when auditing/resolving private @salla.sa/* npm packages — 404 Not Found - GET https://registry.npmjs.org/@salla.sa/... — because dependabot.yml has no registries: block, so Dependabot hits the npm registry unauthenticated.
• https://yourtrack.salla.dev/browse/SAL-1382
• Closes SAL-1382

What is the new behaviour? (You can also link to the ticket here)

• Add an npm-registry registry entry (token from the org-level Dependabot secret NPM_TOKEN, which already exists org-wide — repos like platform and mahlyweb use the same pattern) and attach it to the npm update entry.

Does this PR introduce a breaking change?

• no — config-only change. Dependabot security and version updates start resolving private packages again.

Other information:

Depends on PRs:

• -

Screenshots (If appropriate)

Release Plan❗️

Write how this should deploy to production, and what are the sides effects.

• Backwards Compatibility: No runtime impact — .github/dependabot.yml is CI-only configuration.
• Deployment Order: None — the org-level Dependabot secret NPM_TOKEN already exists.
• Verification Steps: After merge, trigger the Dependabot Updates workflow on the default branch and confirm the run succeeds.
• Rollback: Revert this commit to restore the previous dependabot.yml.
• ENV vars: none

Notify Me

ENV

CLOCKWORK_ENABLE: false
RUN_LARAVEL_CRON: false

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

AI Reviewer: run a review on demand. To trigger the first review automatically, go to your organization or repository integration settings. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}