Revert "build(deps-dev): bump webpack-dev-server from 5.2.6 to 6.0.0 in /app (#769)"

Cypress component testing resolves the top-level webpack-dev-server
and only accepts major 5, so the bump crashed cypress.config.js on
every run ("Unexpected major version of webpack-dev-server").  The
react-scripts dev server was unaffected because it uses its own
nested 4.x, which is what the pre-merge check looked at.

Pin webpack-dev-server below 6 in dependabot.yml until Cypress
supports it.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

.github/dependabot.yml

@@ -80,6 +80,10 @@ updates:
       # @testing-library/react 14+ async act semantics break menu/popover tests.
       - dependency-name: "@testing-library/react"
         update-types: ["version-update:semver-major"]
+      # Cypress component testing resolves the top-level webpack-dev-server and only
+      # accepts major 5; 6 crashes cypress.config.js ("Unexpected major version").
+      - dependency-name: "webpack-dev-server"
+        versions: [">=6"]
     groups:
       npm-dependencies:
         patterns:

app/package.json

@@ -65,7 +65,7 @@
     "@types/react": "^18.3.17",
     "@types/react-dom": "^18.3.5",
     "typescript": "^5.9.3",
-    "webpack-dev-server": "^6.0.0"
+    "webpack-dev-server": "^5.2.6"
   },
   "jest": {
     "transformIgnorePatterns": [