fix: align examples with published contracts

[smiggleworth]

Summary

• refresh the workspace lockfile to the published Askr, server, themes, and UI releases
• keep examples on explicit page registries and current action/MCP contracts
• retain the existing workflow action pin updates in this scoped dependency PR

Fixes #1

Validation

• npm run check
• npm run acceptance
• 4 browser journeys passed
• OpenAPI artifacts current

[Copilot]

Pull request overview

Updates the examples repo to match the currently published Askr/server/themes/UI contracts and dependencies, while keeping existing workflow action pinning changes intact and tightening a couple of example behaviors.

Changes:

• Refreshes resolved package versions in package-lock.json for the published @askrjs/* releases.
• Updates example code/contracts: adjusts an SSR action handler payload and adds MCP origin allowlisting.
• Stabilizes Playwright navigation by requiring an exact “Activity” link match; pins GitHub Actions to SHAs.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
playwright/critical-flows.spec.ts	Makes “Activity” link selection unambiguous via exact: true.
package-lock.json	Updates resolved @askrjs/* package versions to newer published artifacts.
mcp-server/src/main.ts	Adds allowedOrigins for MCP routes (with a noted default resource port mismatch).
api-ssr/src/boot/actions.ts	Aligns action handler response shape by removing conditional redirect on update.
.github/workflows/ci.yml	Pins actions/checkout and actions/setup-node to specific commit SHAs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.