chore(deps): bump express-rate-limit and ip-address

Scope @modelcontextprotocol/sdk (>=1.26.0) to express-rate-limit ^8.6.0 and
@jsonhero/json-infer-types to ip-address ^10.2.0, so both transitive
ip-address resolutions land on 10.2.0 instead of 8.1.0 and 10.0.1.

express-rate-limit 8.2.1 pinned ip-address to an exact version; 8.5.1 onwards
declares a range instead, so moving the parent lets ip-address resolve on its
own. json-infer-types caps ip-address at ^8.1.0 and is already at its latest
release, so that chain needs a scoped override.

The cli-v3 chain is untouched: it resolves @modelcontextprotocol/sdk 1.25.2,
which declares express-rate-limit ^7.5.0 and pulls no ip-address at all.

Regenerated pnpm-lock.yaml. Nothing in the repo imports either package
directly; both chains are transitive under apps/webapp.

Author: claude

package.json

@@ -139,7 +139,9 @@
       "tmp@<0.2.7": "0.2.7",
       "brace-expansion@<1.1.13": "1.1.13",
       "brace-expansion@>=2 <2.0.3": "2.0.3",
-      "brace-expansion@>=5 <5.0.6": "5.0.6"
+      "brace-expansion@>=5 <5.0.6": "5.0.6",
+      "@jsonhero/json-infer-types>ip-address": "^10.2.0",
+      "@modelcontextprotocol/sdk@>=1.26.0>express-rate-limit": "^8.6.0"
     },
     "onlyBuiltDependencies": [
       "@depot/cli",