Declare the type-only peers and stop shipping bundled deps to consumers

publicApi.d.ts type-imports from obsidian, express, and zod, but none of the
three was reachable by a consumer. @types/express and obsidian were
devDependencies, and express 4 ships no types of its own. The failure mode is
silent: TypeScript does not report an unresolved import inside a .d.ts when
skipLibCheck is on -- the Obsidian plugin template's default -- it just widens
the type to any. Verified against a scratch consumer project, where

  const check: string = api.addRoute("/x/");

compiled clean without @types/express and errored TS2322 with it. zod behaves
identically: a bogus { bogus: 12345 } passed as an MCP tool schema is accepted
when zod is absent. So the published types looked precise while handing
extension authors any at the two positions that matter most, with no
diagnostic to notice. All three are now peerDependencies.

The former dependencies list is now devDependencies. esbuild.config.mjs sets
bundle: true and externalizes only what Obsidian provides at runtime
(obsidian, electron, @codemirror/*, node builtins), so express, zod,
node-forge, the MCP SDK and the rest are inlined into main.js and never
resolved from node_modules. They are build inputs. Leaving them as runtime
dependencies made npm install obsidian-local-rest-api fetch thirteen packages
to support a published payload of five files whose only JavaScript contains no
require() calls at all. Nothing about the plugin build changes; both sections
are installed by npm i, and no CI path uses --production or --omit=dev.

The peer ranges are deliberately wider than the pinned devDependencies, since
a consumer's own resolution has to satisfy them too.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>