chore(deps): upgrade LangChain to v1.x to fix security vulnerabilities

[vmuno]

Description:

Summary

Upgrades LangChain dependencies from 0.3.x to 1.x to fix two security vulnerabilities:

• GHSA-r399-636x-v7f6 — Serialization injection enabling secret extraction (high)
• GHSA-fw9q-39r9-c252 — LangSmith prototype pollution (moderate)

Changes

Package	From	To	Type
@langchain/core	^0.3.56	^1.1.40	peerDependency
langchain	^0.3.2	^1.3.3	devDependency
@langchain/openai	^0.3.5	^1.4.4	devDependency

package-lock.json was regenerated from scratch due to version conflicts between the old lock file and the new dependency ranges.

Breaking changes

None for us. Our usage is limited to StructuredTool, BaseToolkit, ToolParams, and CallbackManagerForToolRun — all stable APIs unaffected by v1 changes.

Testing

• npm audit — 0 vulnerabilities
• npm run build — clean
• npm test — 11/11 passing
• MCP server tested manually in Claude Code:
  • Listed time offs ✅
  • Fetched employment by ID ✅