fix: refresh MCP SDK and Playwright dependencies

[robertocyrino]

Summary

• Upgrade @modelcontextprotocol/sdk from 0.5.0 to 1.30.0.
• Upgrade Playwright from the 1.48 line to 1.62.1.
• Add Zod explicitly to satisfy the current MCP SDK peer contract.
• Resolve patched minimatch and brace-expansion releases for npm, Yarn, and Bun, then refresh the repository's tracked Yarn and Bun lockfiles.

Why

A clean dependency resolution from current main reports four high-severity affected packages. The first two are runtime dependencies; minimatch and brace-expansion are build-time-only through shx → shelljs → glob:

• MCP TypeScript SDK DNS-rebinding protection: GHSA-w48q-cv73-mx4w
• Playwright browser-download certificate verification: GHSA-7mvr-c777-76hp
• minimatch regular-expression denial of service, including GHSA-23c5-xmqv-rm74
• brace-expansion denial of service, including GHSA-rgw5-rvv9-x895

The refreshed dependency graph clears the npm and Bun audit findings without changing the server source or its tool definitions.

Testing

• npm install --package-lock-only --ignore-scripts --no-audit followed by npm audit --json — 0 vulnerabilities in the 2026-08-10 resolution; the temporary npm lock was used only for audit verification and is not added to the repository
• yarn install --frozen-lockfile --ignore-scripts --non-interactive — passed
• bun install --frozen-lockfile --ignore-scripts — passed
• bun audit — no vulnerabilities
• npm run build
• node --check dist/index.js
• MCP stdio smoke — initialization and tools/list passed with all 10 existing tools against both the npm/Yarn and Bun-resolved installs
• git diff --check

Risk and rollout

• This crosses the MCP SDK 0.x-to-1.x boundary; TypeScript compilation and an actual MCP initialization/tool-list exchange passed against SDK 1.30.0.
• No application source, tool definitions, or configuration behavior changes in this patch.
• Playwright's updated browser revision may require npx playwright install for existing development environments.
• The repository already tracks yarn.lock and bun.lockb; both are refreshed, and no third lockfile is introduced.
• The exact minimatch and brace-expansion pins match the current glob@7 dependency ranges. If that consumer chain changes, the pins should be reviewed or narrowed.
• Yarn 1.x regenerated the lock without legacy SHA-1 URL fragments; the SHA-512 integrity fields remain present.
• npm-based CI and Docker builds continue to resolve from package.json because the repository does not currently track an npm lockfile.
• Rollout follows the normal release path. Revert this commit to restore the previous dependency graph if a compatibility regression appears.