fix: upgrade zod to v4 to fix global install crash

@modelcontextprotocol/sdk@1.26.0 uses zod/v4 APIs (specifically
z.literal().value getter). When installed globally, npm shared the
project's zod@3.25.5 instead of the SDK's nested zod@4.3.6; the
3.25.5 v4 compat shim lacks the .value getter, throwing
'Schema method literal must be a string' on startup.

Also updates z.record(z.any()) to z.record(z.string(), z.any())
for zod v4 strict record key typing.

446/446 tests passing.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

package.json

@@ -1,6 +1,6 @@
 {
   "name": "excalidraw-mcp-sentinel",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "description": "Hardened, self-hosted Excalidraw MCP server with SQLite persistence, multi-tenancy, auto-sync, security middleware, and 369 tests",
   "main": "dist/index.js",
   "type": "module",
@@ -47,7 +47,7 @@
     "react-dom": "^18.3.1",
     "winston": "^3.11.0",
     "ws": "8.20.0",
-    "zod": "3.25.5",
+    "zod": "^4.3.6",
     "zod-to-json-schema": "^3.22.3"
   },
   "devDependencies": {