fix(ci): sync package-lock.json with the deps added in #17 (#19)

#17 added @modelcontextprotocol/sdk and zod to package.json but installed them
with --no-save, so the lockfile never learned about them. ci.yml runs `npm ci`,
which refuses to install when the manifest and lockfile disagree — so CI has
been red on main since that merge. It was green immediately before it.

No dependency choices change here; the lockfile is regenerated with
`npm install --package-lock-only`.

Co-authored-by: AvaKim <avajiyo@gmail.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: 3 people