security: Fix all npm audit vulnerabilities

- Update @modelcontextprotocol/sdk from ^0.5.0 to ^1.25.2
  - Fixes DNS rebinding vulnerability (GHSA-w48q-cv73-mx4w)
  - Fixes ReDoS vulnerability (GHSA-8r9q-7v3j-jr4g)
- Update nodemailer from ^6.9.0 to ^7.0.12
  - Fixes domain interpretation conflict (GHSA-mm7p-fcc7-pg87)
  - Fixes DoS from recursive calls (GHSA-rcmh-qjqh-p98v, GHSA-46j5-6fg5-4gv3)
- Update vitest from ^1.0.0 to ^4.0.0
  - Fixes esbuild dev server vulnerability (GHSA-67mh-4wv8-2f99)

All 6 vulnerabilities resolved (was: 1 high, 5 moderate)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: jeremylongshore