fix: bump @modelcontextprotocol/sdk to 1.28.0 for security audit (#45)

Resolves high-severity vulnerabilities:
- ReDoS vulnerability (GHSA-8r9q-7v3j-jr4g)
- Cross-client data leak via shared server/transport reuse (GHSA-345p-7cg4-v4c7)

Author: bearmug