fix: declare @sinclair/typebox as a peer dependency

[WangLuFeiUid]

Problem

Starting Pi with this extension installed prints a warning:

Warning: Extension package "<...>/pi-wechat-assistant/package.json": Host-provided
extension packages must be declared in peerDependencies with a "*" range, not
dependencies: @sinclair/typebox. Installed copies can bypass the extension loader
and create duplicate runtime modules.

@sinclair/typebox is provided by the Pi host at runtime — it is part of the
loader's host-provided package set. Declaring it in dependencies triggers the
warning on every startup and risks a physically separate copy of typebox being
installed next to the extension, which can bypass Pi's extension module mapping
and produce duplicate module instances.

Fix

• peerDependencies: add "@sinclair/typebox": "*"
• dependencies: remove @sinclair/typebox
• devDependencies: keep "@sinclair/typebox": "^0.34.49" so local typecheck and
  the test suite still resolve a real installation
• regenerate package-lock.json

This follows Pi's own guidance in packages.md ("Declare the host-provided
packages listed above in peerDependencies with a "*" range and do not bundle
them" / "Do not list host-provided packages in dependencies") and mirrors the
pattern already used in this repository for @earendil-works/pi-coding-agent,
which is declared in both peerDependencies ("*") and devDependencies.

Verification

• npm ci — installs cleanly
• npm run typecheck — passes
• npm test — 49 tests passed across 6 files
• Re-checking the manifest against the loader's host-provided predicate now yields
  no matches in dependencies, so the warning is gone

No CHANGELOG.md entry included, since releases here appear to be cut separately —
happy to add one if you prefer.

[WangLuFeiUid]

CI note: the run needs a maintainer approval, not a code fix

The CI run on this PR is stuck at action_required — that is GitHub's "Approve and run" gate for first-time contributors, so the workflow never started. Same state as the other open PRs here (#13, #10, #9).

Since the workflow cannot start on its own, I reproduced the exact steps from .github/workflows/ci.yml locally:

CI step	Local result
npm ci	installs cleanly
npm run typecheck	tsc --noEmit, no output
npm test	49 tests passed, 6 files

Re-checking the manifest against the loader's host-provided predicate (HOST_PROVIDED_EXTENSION_PACKAGES in dist/core/resource-loader.js) now yields no matches in dependencies, so the startup warning no longer triggers.

This is the same root cause as #12 — the fix there was described as moving the package to peerDependencies, which is what this PR does.