`@almadar/server` only imports express as types (Router, Request,
Response, NextFunction). Express 5 is GA and the rest of the monorepo
(runtime-verify-tool, etc.) is on ^5.2.1. Standardising on v5 instead
of straddling v4/v5 keeps the contract crisp.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>