chore(dxt): slim the DXT bundle

[aaronjmars]

Why

After #86, a fresh ./build-dxt.sh produced a 36 MB opendia.dxt (the committed one was 12.7 MB). The bundle carried the whole extension source plus built Chrome and Firefox copies, and each of the three copies had the 11 MB logo.mp4.

Claude Desktop only runs the MCP server out of a DXT. The extension was added to the bundle back in the first version of the script, and the only thing pointing at it was the EXTENSION_INSTALL.md written into the DXT itself. The README already tells users to install the extension from the opendia-chrome-*.zip / opendia-firefox-*.zip assets on the Releases page, so the bundled copies are not needed.

What changed

• Dropped the extension from the DXT, along with the step that ran npm install + build in opendia-extension/ during a DXT build.
• Server deps now install with npm ci --omit=dev from opendia-mcp's own package.json and package-lock.json, instead of a hand-written package.json with no lockfile. Side effect: the DXT moves from Express 4.21.2 to Express 5.2.1, the version npx opendia and CI already use.
• Pruned docs (*.md except license files), test/tests/example(s)/.github dirs and lint/coverage dotfiles from node_modules. License files stay.
• Fixed the icon lookup: icons moved to opendia-extension/icons/, so a fresh build had been shipping without icon.png even though the manifest points at it.
• Removed the copy of a root README.md that does not exist (it lives in .github/), and pointed the in-bundle install guide and the script's closing hint at the release zips.
• Rebuilt and committed opendia.dxt; CHANGELOG entry under Unreleased / Removed.

Size

	Size	Files
Committed before this PR	12,711,024 bytes	806
Fresh build on main (after #86)	36,113,517 bytes	845
This PR	685,498 bytes	501

Bundle now holds only: manifest.json, server.js, package.json, package-lock.json, icon.png (128x128), LICENSE, EXTENSION_INSTALL.md, node_modules/ (68 packages).

Verification

• shellcheck build-dxt.sh: clean before and after.
• Unzipped the new DXT: no extension/, no .mp4, no test dirs; manifest version 1.1.3 with the OPENDIA_* env mapping from fix(dxt): apply user_config settings to the server #86; express 5.2.1, ws 8.21.3, cors 2.8.6.
• Started the bundled server.js with OPENDIA_WS_PORT=44388 OPENDIA_HTTP_PORT=44389 and stdin from /dev/null:
  • GET /ports returned {"websocket":44388,"http":44389,...}
  • GET /health returned {"status":"ok",...,"ports":{"websocket":44388,"http":44389}}
  • stopped it by its exact PID.