fix: the Zenodo record carries a wrong license id and a wrong version

Problem

The Zenodo GitHub integration archived the v0.2.0 release. It derived the metadata from
CITATION.cff, and two fields came out wrong.

Record: 10.5281/zenodo.22198692. Concept DOI:
10.5281/zenodo.22198691.

The license id does not exist

apgl-v3 is not in the Zenodo license vocabulary. The lookup returns 404.

GET https://zenodo.org/api/vocabularies/licenses/apgl-v3       -> 404
GET https://zenodo.org/api/vocabularies/licenses/agpl-3.0-only -> 200 "GNU Affero General Public License v3.0 only"

The string also transposes two letters: apgl against agpl. The record therefore states no usable
license, although CITATION.cff holds the correct SPDX value AGPL-3.0-only.

The version repeats the tag

Zenodo took v0.2.0 from the Git tag. CITATION.cff holds 0.2.0. The v prefix belongs to the
tag, not to the version of the software.

What is already correct

The rest of the derived metadata is right, so only these two fields need a fix.

• Title, description, and keywords match CITATION.cff.
• The creator carries the ORCID and the affiliation.
• The resource type is software.
• The concept DOI and the version DOI both resolve.

Suggested fix

Add a .zenodo.json file to the repository root. Zenodo reads that file first and ignores its own
derivation for the fields the file sets.

{
  "title": "Quarto MCP",
  "version": "0.2.0",
  "license": "agpl-3.0-only",
  "upload_type": "software"
}

Caution: .zenodo.json becomes a fourth place that holds the version number. #22 removed that
duplication for src/server.ts. Extend test/version.test.ts to cover .zenodo.json, so the gate
fails on drift.

Points to settle

• A .zenodo.json file overrides CITATION.cff for every field it names. Keep it small. Name the
  two broken fields only, so CITATION.cff stays the source for the rest.
• Confirm the exact license identifier that the current Zenodo API accepts at upload time. The
  vocabulary answers for agpl-3.0-only, but the integration may expect another spelling.
• Decide whether to correct the existing v0.2.0 record by hand. Zenodo allows an edit of the
  published metadata, and the DOI does not change.

Verify

1. Create the next release.
2. Read https://zenodo.org/api/records/<id> and check metadata.version and metadata.license.

Start with test/version.test.ts and the version-handling change from #22, then inspect the repository-root metadata conventions around src/server.ts. Add the minimal Zenodo override for the broken fields, extend the version test to detect drift, and verify the next release through the Zenodo records API.