chore(server): add zod as a direct dependency

Zod 4.4.3 is already resolved in the lockfile as a transitive dependency of
@modelcontextprotocol/sdk, but pnpm's strict node_modules will not resolve it
from apps/server without an explicit entry. Pinned to the resolved version so
the server and the SDK share a single instance.

Version >= 4.2.0 is also what the SDK v2 upgrade will require, since v2 takes
Standard Schema objects for tool schemas and drops zod v3 support.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MZioYpY8NR8UM5tAQ7BkfN

apps/server/package.json

@@ -22,7 +22,8 @@
     "osc-min": "2.1.2",
     "sanitize-filename": "^1.6.3",
     "ws": "^8.18.0",
-    "xlsx": "^0.18.5"
+    "xlsx": "^0.18.5",
+    "zod": "4.4.3"
   },
   "devDependencies": {
     "@types/cookie-parser": "1.4.10",

pnpm-lock.yaml

@@ -275,6 +275,9 @@ importers:
       xlsx:
         specifier: ^0.18.5
         version: 0.18.5
+      zod:
+        specifier: 4.4.3
+        version: 4.4.3
     devDependencies:
       '@types/cookie-parser':
         specifier: 1.4.10