docs: add dependency review guide and link from README

[eleven-smg]

What

Adds docs/dependency-review.md, a dependency review standard for the PocketPay SDK, and links it from the README documentation list.

The guide covers:

• Guiding principles for keeping the dependency tree small and auditable
• The SDK's current runtime and development dependencies and their purpose
• Criteria for adding a dependency (purpose, runtime vs development, maintenance status, security risk, size, license, alternatives)
• Criteria for updating a dependency (changelog review, semver, security-first, one update per PR, local verification, lockfile)
• Guidance on removing dependencies
• A review checklist for any dependency change

Why

Dependency changes can introduce security, bundle-size, and compatibility risks. A written standard gives contributors a consistent process and supports future security reviews, as requested in the issue.

Notes

Documentation only - no source or dependency changes. README updated to link the new guide.

Closes #133