fix(sec): move mcp-sdk to devDeps (not used by prod server), pin picomatch>=4.0.4

Author: markaspot

package.json

@@ -3,11 +3,11 @@
   "version": "0.2.0",
   "description": "MCP Bridge for GeoReport v2 (Open311) API",
   "type": "module",
-  "main": "dist/index.js",
+  "main": "dist/server.js",
   "scripts": {
     "dev": "tsx watch src/index.ts",
     "build": "tsup src/server.ts --format esm --platform node --target node22 --minify --clean",
-    "start": "node dist/index.js",
+    "start": "node dist/server.js",
     "test": "vitest",
     "test:watch": "vitest watch",
     "test:coverage": "vitest run --coverage",
@@ -30,14 +30,14 @@
   "author": "",
   "license": "BUSL-1.1",
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^0.5.0",
     "cors": "^2.8.5",
     "dotenv": "^16.3.1",
     "express": "^4.18.2",
     "winston": "^3.11.0",
     "zod": "^3.22.4"
   },
   "devDependencies": {
+    "@modelcontextprotocol/sdk": "^0.5.0",
     "@types/cors": "^2.8.17",
     "@types/express": "^4.17.21",
     "@types/node": "^20.11.0",
@@ -49,5 +49,8 @@
     "tsx": "^4.7.0",
     "typescript": "^5.3.3",
     "vitest": "^1.2.0"
+  },
+  "overrides": {
+    "picomatch": "^4.0.4"
   }
 }