Fix CodeQL alert 1154 and add client-v3 to CI tooling

Guard convention-based Pinia dispatch with Object.hasOwn() to prevent
accidental dispatch to prototype-inherited method names (CodeQL js/unvalidated-dynamic-method-call #1154).

Add dependabot npm entry for /client-v3 and a client-v3 labeler rule so
automated dependency updates and PR labels work once client-v3 lands in dev.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: Tim020

.github/dependabot.yml

@@ -18,6 +18,15 @@ updates:
         update-types: ["version-update:semver-major"]
     versioning-strategy: increase
     target-branch: dev
+  - package-ecosystem: "npm"
+    directory: "/client-v3"
+    schedule:
+      interval: "daily"
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+    versioning-strategy: increase
+    target-branch: dev
   - package-ecosystem: "npm"
     directory: "/electron"
     schedule:

.github/labeler.yml

@@ -33,6 +33,9 @@ labels:
 - label: "client"
   files:
     - "electron/.*"
+- label: "client-v3"
+  files:
+    - "client-v3/.*"
 - label: "server"
   files:
     - "server/.*"

client-v3/src/composables/useWebSocket.ts

@@ -139,7 +139,7 @@ async function dispatchAction(action: string, data: Record<string, unknown>): Pr
   if (pinia) {
     const storeMap = (pinia as unknown as { _s: Map<string, Record<string, unknown>> })._s;
     for (const store of storeMap.values()) {
-      if (typeof store[camelAction] === 'function') {
+      if (Object.hasOwn(store, camelAction) && typeof store[camelAction] === 'function') {
         await (store[camelAction] as (d: Record<string, unknown>) => Promise<void>)(data);
         return;
       }