docs: Align docs/DEPS.md with client workspace dependencies and server override pins

[atomantic]

Problem

In docs/DEPS.md:

1. Lines 45-62 (Client deps table): Omitted direct dependency @scalar/api-reference-react (client/package.json:26, version 0.9.66), which was added in PR feat: add API explorer and agent tool interface #5248 to render the interactive OpenAPI 3.0.3 reference in Dev Tools → API Explorer (client/src/components/devtools/api/OpenApiView.jsx).
2. Line 48: Lists @dnd-kit/utilities as a Tier 1 client dependency, but @dnd-kit/utilities is not declared in client/package.json (only @dnd-kit/core and @dnd-kit/sortable are direct dependencies).
3. Line 134: Under "Override Pins (overrides)", lists sharp@0.35.3 (server only, collapses the nested copy @huggingface/transformers requests), but server/package.json:55 and server/package.json:35 are pinned to sharp@0.35.4.

Trigger

An operator or agent runs dependency audits (/do:depfree) or reviews package supply-chain security and license compliance against docs/DEPS.md.

Impact

docs/DEPS.md is no longer a faithful single source of truth for repository dependencies: unlisted packages bypass documented classification and removed packages remain listed as direct dependencies.

Fix

Edit docs/DEPS.md:

1. Add @scalar/api-reference-react to the Client deps table:
   | \@scalar/api-reference-react` | 1 | KEEP | Dev Tools → API Explorer | Interactive OpenAPI reference UI rendering |`
2. Remove the @dnd-kit/utilities row from the Client deps table.
3. Update the sharp override pin entry on line 134 from sharp@0.35.3 to sharp@0.35.4.
   (Rejected alternative: Removing @scalar/api-reference-react from client/package.json was rejected because it is actively imported by client/src/components/devtools/api/OpenApiView.jsx.)

Acceptance criteria

• docs/DEPS.md Client deps table includes @scalar/api-reference-react and omits @dnd-kit/utilities.
• docs/DEPS.md lists sharp@0.35.4 under Override Pins.