Bump @modelcontextprotocol/sdk to 1.30.0

Clears the last two outstanding advisories, taking npm audit to zero.

GHSA-8r9q-7v3j-jr4g is a ReDoS in the SDK and applies directly.
GHSA-345p-7cg4-v4c7, the cross-client data leak, does not: it requires
reusing one server/transport instance across clients, and McpHandler
already builds a fresh McpServer per session because Server.connect
binds a single transport. Bumping regardless, rather than carrying a
suppression that a later refactor could quietly invalidate.

The pin is exact, so this needed an explicit bump. As a side benefit the
bundle drops from 4.1mb to 3.6mb.

Landing this required the preceding write-path fix: 1.30.0 is fast
enough to expose a pre-existing stale-cache race in the plugin, which
made an MCP integration test fail in roughly a third of runs.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>