fix(deps): bump proxy-addr to 2.0.8 for GHSA-jqcg-44mw-7w3h (#349)

bun audit fix within existing ranges: proxy-addr 2.0.8 (critical IP
spoofing via IPv4-mapped IPv6 trust subnet), plus in-range bumps of
@modelcontextprotocol/sdk, sharp, dompurify, fast-uri, ip-address,
brace-expansion, source-map-js. Lockfile only.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: ralyodio