v1.6.1 — research tool packaging hotfix + OpenAlex API-key migration

Patch release covering the v1.6.0 regression hotfix and follow-up cleanup merged via #22 (supersedes #21).

Fixed

• Restored v1.6 research tool scripts (OpenAlex, Unpaywall, CORE, RSS, resolve_pdf) to the npm package allowlist — closes #20.
• Hardened scripts/ci-package.mjs so every Python tool the installer copies must be declared in package.json files, preventing the same class of regression.

Changed

• OpenAlex auth migration: OPENALEX_MAILTO (deprecated polite-pool) → OPENALEX_API_KEY (current api_key query parameter). The new key enables OpenAlex's free daily API budget and usage tracking.
  • Upgrade action: rename OPENALEX_MAILTO to OPENALEX_API_KEY in your local .env. The old variable is ignored. Get a free key at https://openalex.org/settings/api.
• fetch_openalex.py search per_page clamped to OpenAlex's documented max of 100; explicit 401/403 handling surfaces a clear error message when the key is rejected.

CI

• Dropped Node 22 from the test matrix on all OSes due to an upstream node:test IPC bug (ERR_TEST_FAILURE / structured-clone deserialization) that surfaced intermittently on Windows, macOS, and Linux runners.
• Cold-start budget gate now runs only on ubuntu-latest; Windows and macOS hosted runners cannot meet the 350 ms threshold due to filesystem latency.
• Node 20 / windows-latest marked continue-on-error: true to surface a remaining Windows-only node:test flake as a warning rather than blocking the build (tracked in #23).

Full diff: v1.6.0...v1.6.1