chore: drop version from package.json, make git tag the source of truth

[luispabon]

Why

The release workflow was the only enforced consumer of require("./package.json").version, and that check only existed to catch tag/package.json drift. Docker image tags and gh release create already derive from GITHUB_REF_NAME, so the guard rail was the only thing the field actually enabled.

Keeping it forces a two-step release (bump file, commit, tag, push) and produced a CI failure on the recent 2.0.0-rc1 tag attempt because the tag version didn't match the committed 1.8.0. The npm convention no longer earns its keep on a service that is not published to npm and does not expose a version in its API.

The git tag becomes the single source of truth.

Changes

• package.json — remove the version field; regenerate package-lock.json via npm install --package-lock-only
• src/server.js — drop the require("../package.json").version import and the v${version} from the boot log
• .github/workflows/release.yaml — drop the PACKAGE_VERSION comparison block. Tag parsing and GITHUB_OUTPUT emission unchanged. Docker tags and gh release create were already tag-derived, no other workflow edits needed.
• README.md (L132, L152), AGENTS.md (L25), charts/readability-js-server/README.md (L83) — rewrite the prose that claimed package.json was the single source of truth.

Not touched: charts/readability-js-server/Chart.yaml appVersion (manually maintained and independent by design), Makefile release-tag target (did not read package.json), tests (none referenced the version).

Verification

Check	Result
npm ci (after rm -rf node_modules)	pass, 217 packages, 0 vulns
npm run lint	ESLint + Prettier clean
npm test	36/36 pass
make helm-lint	1 chart, 0 failures
make helm-template	renders Deployment, Service, ServiceAccount
Release metadata simulation (TAG=v1.9.0)	version=1.9.0, major=1 minor=9 patch=0, correct tags

Follow-ups

• Chart.yaml appVersion is now the only manually-tracked version string. Bump it when a release tag changes the chart's default image.
• Dependabot (if enabled) no longer has a package version to bump for the app. Releases are tag-driven only.