v1.4.0

Correct serverInfo.version, pin Docker builds to uv.lock, and make the
connector website/icon configurable.

Surfaced while verifying v1.3.0's icon/website_url wiring end-to-end
against the live server via MCPJam Inspector's OAuth debugger: it showed
v1.29.0, which turned out to be the installed mcp SDK package's own
version, not zotero-mcp's (FastMCP has no version= constructor param, so
the SDK silently falls back to its own package version). Digging into why
production had mcp==1.29.0 while the local lockfile pins 1.28.1 found
the real bug: the Dockerfile installed via pip install . straight from
pyproject.toml, completely bypassing uv.lock, so production dependency
versions could silently drift from what's tested locally/in CI.

• serverInfo.version now correctly reports zotero-mcp's own installed
  version (mcp._mcp_server.version set from importlib.metadata),
  matching pyproject.toml.
• Dockerfile now installs via uv sync --frozen --no-dev, so the image
  gets exactly what's pinned in uv.lock -- a stale/drifted lock now
  fails the build loudly instead of silently resolving to newer releases.
• MCP_WEBSITE_URL is now an optional env var (previously hardcoded) --
  website_url/icons are cleanly omitted when it's unset instead of
  building a broken icon URL. Documented in .env.example, the README's
  Configuration section, and the module docstring.
• The docs landing page now shows the connector icon too (favicon +
  header), not just the MCP server's own serverInfo.