fix: declare root bundled runtime dependencies

[mturac]

Summary

• Add the runtime packages imported by the root package's bundled CLI/server/client files to the root package dependencies.
• Keep the published mcp-inspector bin usable with strict package managers, where the root package cannot rely on dependencies declared only by sibling workspace packages.

Fixes #1513.
Addresses #873.

Verification

• npm install --package-lock-only (ran the repository prepare build successfully)
• npm run build
• npm run prettier-check
• npm run test-cli (85 tests passed)
• git diff --check
• Packed the root package with npm pack --ignore-scripts --json, installed the tarball into a temporary pnpm project, verified the root package can resolve commander, cors, express, express-rate-limit, and serve-handler, and ran ./node_modules/.bin/mcp-inspector --help successfully

[mturac]

Noting the overlap with #1144 so review does not split unexpectedly.

This PR keeps the same root dependency fix direction for #873, but rebases it onto the current 0.22.x package metadata, updates package-lock.json, and also covers the newer #1513 pnpm dlx @modelcontextprotocol/inspector failure. If maintainers prefer to continue from #1144 instead, I can close this one.

[mturac]

Added a fresh package smoke on the current branch head.

Validation:

npm ci
npm run build
npm run prettier-check
npm run test-cli
git diff --check upstream/main...HEAD

I also packed the root package with npm pack --ignore-scripts --pack-destination <tmp>, installed that tarball into a fresh temporary project with pnpm 11.9.0, and verified the published bin starts:

Usage: inspector-bin [options]

That covers the pnpm dlx @modelcontextprotocol/inspector class of failure from #1513 and the root runtime dependency issue from #873.

[mturac]

Closing this to avoid splitting review with the overlapping dependency fix in #1144. I will keep the active queue focused on the OAuth DCR fix in #1543 instead.