build: move shadcn to devDependencies and apply non-breaking audit fixes

shadcn is a scaffolding CLI, not a runtime library: nothing under src/ imports it
and no npm script invokes it. Having it in dependencies pulled
@modelcontextprotocol/sdk -> express -> body-parser into the production tree of a
static SPA.

Production dependency count drops from 412 to 172, and express, body-parser and
the MCP SDK leave the production tree entirely. `npm audit fix` then cleared the
postcss path-traversal (high) and dompurify (low) advisories.

Two react-router advisories remain and are deliberately not addressed: 7.18.1 is
already the latest published version, so no fix exists yet, and the advisory covers
RSC mode while this app is a client-side BrowserRouter SPA that never enters it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: TheStreamCode