v0.3.5 — proxy-addr 2.0.8 (critical advisory)

Bumps proxy-addr to 2.0.8 for GHSA-jqcg-44mw-7w3h, plus in-range dependency bumps (MCP SDK, sharp, dompurify, fast-uri, ip-address). Lockfile only. #349