fix: CI coverage, paused-mint warning, distribution preflight, Dependabot

[Devzillavibes]

• closes ci: web.yml runs "npm test" instead of "npm run test:ci", so coverage is never collected #292 — swap npm test → npm run test:ci in web.yml so Jest runs with --ci --coverage
• closes feat: DistributionPanel doesn't surface payment-token balance or allowance before submitting #293 — DistributionPanel now shows the issuer's payment-token balance and dividend contract allowance before submit, with red/amber callouts when either is insufficient
• closes feat: TokenPanel mint form gives no warning when the token contract is currently paused #294 — MintCard in TokenPanel shows an amber warning banner when the token is paused, matching the existing PauseCard pattern
• closes chore: add Dependabot or Renovate config for npm dependency updates #295 — add .github/dependabot.yml for weekly npm updates; Stellar SDK and test packages are grouped

[drips-wave]

@Devzillavibes Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits