v0.4.0: Symbolic-op hardening, fraction_unsupported, length/len count aliases

Symbolic-op hardening, fraction_unsupported, length/len count aliases

simplify/derivative now run on the hardened math.js instance, closing a constant-folding bypass; a lockfile refresh clears all 9 bun audit advisories.

Added:

• fraction_unsupported — dedicated error when numericType "Fraction" hits an irrational/transcendental result (sqrt, sin, log), with retry guidance; previously surfaced as the misleading parse_failed (#19)
• length/len aliases → math.js count, registered per hardened instance and mirrored into calculator://help (#20)

Changed:

• numericType "Fraction" and expression descriptions tightened to name the exactly-rational limit and the new aliases (#19, #20)

Security:

• simplify/derivative reuse the hardened default math.js instance — constant-folding can no longer execute disabled functions or leak the redacted version / function source; both symbolic paths run the .toString()/.toLocaleString() AST guard (#18)
• bun audit: 9 advisories (2 high, 6 moderate, 1 low) → 0 — transitive hono 4.12.26 → 4.12.27, vite 8.0.14 → 8.1.3, js-yaml 3.14.2 → 3.15.0

Dependency bumps:

• @cyanheads/mcp-ts-core ^0.10.9 → ^0.10.10
• @biomejs/biome ^2.5.0 → ^2.5.2
• @types/node ^26.0.0 → ^26.1.0

199 tests pass; bun run devcheck clean.