platform-cli doctor pins vulnerable next 16.3.6 and MCP SDK 1.30.0, blocking security fixes downstream #14

Problem

@codelitdev/platform-cli (0.4.2) doctor pins exact versions in packages/platform-cli/src/preset.json:

• next: 16.3.6
• @modelcontextprotocol/sdk: 1.30.0

Next.js 16.3.6 has two critical RCE advisories that are fixed in 16.4.1. The dependency-audit PRs bump downstream products to the patched versions, and that makes the Platform conformance "verify" check (platform-cli doctor) fail:

• codelitdev/sendlit#21: next 16.4.1 vs pinned 16.3.6
• codelitdev/medialit#193: next 16.4.1 vs pinned 16.3.6, and @modelcontextprotocol/sdk 1.32.1 vs pinned 1.30.0

Lint and tests pass on both PRs. Only the conformance pin check fails. As things stand, a product can either stay conformant or take the security fix, not both.

Proposed fix

1. Bump the preset pins to next 16.4.1 and @modelcontextprotocol/sdk 1.32.1 (or the latest 1.x).
2. Bump templates/saas-product/apps/web/package.json (next 16.3.6) to match, since the preset takes its pins from the template.
3. Release a new platform-cli version.
4. Optional: have doctor accept patch/minor versions at or above the pin, or let security patch bumps through, so future security fixes don't break conformance.

Related but separate: #10 (MCP SDK 2 migration).

Filed from the CodeLit dependency audit.