chore: refresh JS deps to clear security alerts

[tnm]

Summary:

• Refresh lockfiles for docs and kit-mcp-site using npm audit fix --package-lock-only
• Update TypeScript client lint toolchain (@typescript-eslint/parser, @typescript-eslint/eslint-plugin, eslint) and regenerate lockfile
• Clear npm audit vulnerabilities across all JS workspaces

Validation:

• npm audit --package-lock-only in docs: 0 vulnerabilities
• npm audit --package-lock-only in kit-mcp-site: 0 vulnerabilities
• npm audit --package-lock-only in clients/typescript: 0 vulnerabilities
• npm run build, npm run lint, npm test -- --runInBand in clients/typescript