feat: LangChain integration for Python SDK - #69

* chore(deps): resolve every open Dependabot alert across npm and pip manifests

131 open alerts, six manifests, all npm or pip (no Cargo alerts).

front: next 16.2.1 -> 16.2.11, postcss ^8.5.23; nanoid and sharp via audit fix.
demo: hono ^4.12.34, ws ^8.21.0, nodemailer ^6 -> ^9 (createTransport and
  sendMail are unchanged); esbuild and follow-redirects via update.
inputlayer-js: ws ^8.21.0; vite, vitest, postcss, nanoid, picomatch via
  update; esbuild pinned to ^0.28.1 through an override because tsup's range
  still admits the vulnerable line.
api-client: orval ^8.5 -> ^8.22 (two import-time RCEs and an SSRF);
  fast-uri, js-yaml, linkify-it, markdown-it, brace-expansion, picomatch
  via update; same esbuild override.
inputlayer-py: idna, langchain-core, langchain-openai, langgraph-checkpoint,
  langgraph-sdk, langsmith, pytest, urllib3 relocked. langsmith's patched
  line needs websockets >= 15, so the bound widens to >=13,<16; the client
  already imports websockets.asyncio.client, which is the API that survives.

Removed docs/site: a Nextra 2 skeleton with no pages directory and no
lockfile, last touched in #69, referenced by nothing in CI or the Makefile
(the live site is front/). It carried 15 Next.js 13 advisories no build
would ever exercise. Removed packages/api-client/bun.lock: out of sync with
package-lock.json, and nothing installs with bun.

Verified: npm audit reports 0 vulnerabilities in all four npm packages;
front builds; demo builds; inputlayer-js typechecks, builds, and passes 96
unit tests under Node 22; api-client builds; inputlayer-py passes 974 unit
tests.

* fix(deps): exact Next pin, targeted lockfiles, docs README after review

- front: Next pinned exactly at 16.3.4 (was loosened to a caret). 16.2.11
  closes the Next advisories but vendors postcss 8.5.22 and depends on
  sharp 0.34, both still flagged; 16.3.x is the first line where the
  vendored copies are patched, and it is what the earlier build actually
  ran against.
- demo, inputlayer-js, api-client: lockfiles rebuilt from main with only
  the flagged packages moved. Drops the unrelated @types/node 25 -> 26 and
  zod 3 -> 4 majors that a blanket npm update had swept in. Remaining
  majors are what the bumped packages themselves require (commander for
  orval 8.27) or were the alert (picomatch 2 -> 4).
- demo: esbuild override, same reason as the other two (tsx's range still
  admits the vulnerable line).
- vite in inputlayer-js resolved under Node 22: npm's engine check on
  Node 21 silently refused to move it past 7.3.1.
- docs/README.md and .gitignore no longer mention the removed docs/site.

Verified from clean installs: npm ci passes in all four packages; front
builds; demo builds; inputlayer-js typechecks, builds, 96 tests pass under
Node 22; api-client typechecks and builds; npm audit is 0 everywhere.