v0.3.3: Security patch: retry classification, typed canvas errors, DataCanvas preview paging

Security patch: retry classification, typed canvas errors, DataCanvas preview paging

Reclassifies non-retryable openFDA query failures, types the disabled-DataCanvas
error, and fixes canvas-spillover preview limit/skip — plus a bundled dependency
refresh clearing 8 security advisories.

Fixed:

• openfda-service no longer retries deterministic 5xx query failures (malformed
  search syntax, count on a non-keyword field); reclassified to a non-retryable
  query_error. Marker-free/transient 5xx stay retryable. (#14)
• openfda_dataframe_describe / openfda_dataframe_query throw a typed
  canvas_disabled error when DataCanvas is disabled, instead of an untyped
  InternalError. (#15)
• Canvas spillover's inline preview now honors limit/skip on all 8 search tools
  plus openfda_lookup_ndc; the full matched set still stages to the canvas. (#18)

Changed:

• openfda-service adopts the framework's fetchWithTimeout (Bun-safe timeout,
  http.client.request.duration telemetry, api_key-redacted URLs).

Dependency bumps:

• @cyanheads/mcp-ts-core ^0.10.9 → ^0.10.10
• @biomejs/biome ^2.5.0 → ^2.5.2
• @types/node ^26.0.0 → ^26.1.0

Security:

• hono 4.12.26 → 4.12.27 — CORS wildcard-origin-with-credentials (high) plus
  4 moderate issues (serve-static path traversal, Lambda Set-Cookie merge,
  Body-Limit bypass, Lambda@Edge header drop)
• js-yaml 3.14.2 → 3.15.0 — quadratic-complexity DoS via repeated aliases (moderate)
• vite 8.0.14 → 8.1.3 — server.fs.deny bypass on Windows (high), launch-editor
  NTLMv2 hash disclosure (moderate)

bun audit: 8 advisories (2 high, 6 moderate) → 0.

323 tests pass; bun run devcheck clean.