Dependabot: remove duplicate /apps/web npm entry that skips the root lockfile #2584

Problem

.github/dependabot.yml has two npm update entries covering the same code:

• directory: "/": the npm workspaces root. Its package-lock.json covers apps/web, so updates from this entry bump apps/web/package.json and the root lockfile together (for example, the grouped PR fix: bump the npm-minor-patch group across 1 directory with 6 updates #2574).
• directory: "/apps/web": this entry opens a separate PR per package that only edits apps/web/package.json. It doesn't update the root package-lock.json, so npm ci and the node-engines floor test fail. It also duplicates updates the root entry already proposes.

Current duplicates from the /apps/web entry: #2570 (@ai-sdk/react) and #2573 (ai) duplicate the root group PR #2574. #2572 (@opentelemetry/resources 3.0.0) duplicates the 3.0.0 bump already on main. #2402 (stripe 23.0.0) is a stale major bump on the same /apps/web path.

Acceptance criteria

• Remove the /apps/web npm entry from .github/dependabot.yml, so the root entry is the only npm source and apps/web stays covered through the workspace root.
• Leave the pip, /sdk/python and github-actions entries unchanged.