chore(ci): extend Dependabot to the python/ and webpage/site dependency roots

## Summary

Dependabot covers Cargo and GitHub Actions but not the two other dependency roots that CI actively gates on: the Python client and the download webpage. Add update blocks for both.

## Background

`.github/dependabot.yml` has exactly two `updates` entries, `cargo` at `/` and `github-actions` at `/`. The Python client (`python/pyproject.toml`) pins runtime and dev dependencies and is gated by `.github/workflows/python.yml`; the webpage (`webpage/site/package.json`, with a committed `pnpm-lock.yaml`) pins Next, React, and the frontend toolchain. Neither root gets automated update PRs today.

## Proposed Solution

Add two `updates` blocks, `pip` at `/python` and `npm` at `/webpage/site`, copying the schedule, label, and commit-message conventions already in the file. The existing `ignore` comment block shows the house style for justifying entries.

## Implementation Notes

- `.github/dependabot.yml` currently defines `package-ecosystem: "cargo"` at `directory: "/"` and `package-ecosystem: "github-actions"` at `directory: "/"`.
- `python/pyproject.toml:28-31` pins `openai>=1.40` / `httpx>=0.27` plus a dev extra.
- `webpage/site/package.json` pins Next 16.1.1, React 19.2.3, framer-motion, eslint, and tailwind, with `webpage/site/pnpm-lock.yaml` committed.

## Acceptance Criteria

- [ ] Dependabot config covers `python/` and `webpage/site/` with conventions matching the existing entries

---

## Original Suggestion

### Title: chore(ci): extend Dependabot to python/ and webpage/site

Dependabot covers Cargo and GitHub Actions but not the two other dependency roots that CI actively gates on: the Python client and the download webpage.

## Evidence

- `.github/dependabot.yml` — exactly two `updates` entries: `cargo` at `/` and `github-actions` at `/`
- `python/pyproject.toml:28-31` — pins `openai>=1.40` / `httpx>=0.27` plus a dev extra; `.github/workflows/python.yml` gates PRs on this package
- `webpage/site/package.json` — pins Next 16.1.1, React 19.2.3, framer-motion, eslint, tailwind, with a committed `webpage/site/pnpm-lock.yaml`

## Suggested fix

Two new `updates` blocks (`pip` at `/python`, `npm` at `/webpage/site`) copying the schedule/label/commit-message conventions already in the file; the existing `ignore` comment block shows the house style for justifying entries.

## Acceptance criteria

- [ ] Dependabot config covers `python/` and `webpage/site/` with conventions matching the existing entries

Start with .github/dependabot.yml and compare its existing cargo and github-actions update entries. Check python/pyproject.toml and webpage/site/package.json to confirm the dependency roots, then add matching pip and npm coverage. Done means both directories are covered with the existing schedule, label, and commit-message conventions.

Written by the indexing model from the issue text.