chore(mcp): bump zerosmtp-mcp to 1.0.3 to publish the basic-authentication keyword

[msgwing]

Why

PR #433 (2026-09-10) added the basic-authentication keyword to
packages/zerosmtp-mcp/package.json but a metadata-only change to
package.json does not change anything on registry.npmjs.org until a new
version is actually published - the live package has stayed on 1.0.2 for 10
days with the old 7-keyword list. This is a version bump only, so the new
publish carries that keyword to the registry.

Change

1.0.2 -> 1.0.3 in both packages/zerosmtp-mcp/package.json and
packages/zerosmtp-mcp/server.json (both places, kept in sync per the MCP
registry's own validation - it checks that the declared package version
matches what actually exists on npm).

Test plan

• python tools/check-mcp-server.py - clean, version 1.0.3, both descriptions agree.
• node --test test/*.test.js in packages/zerosmtp-mcp - 10/10 pass.
• After merge: dispatch publish-npm.yml for zerosmtp-mcp, then verify
  curl https://registry.npmjs.org/zerosmtp-mcp/latest returns 1.0.3 with
  8 keywords - a workflow success message is not proof, the registry read is.

BOARD: MERGE - a version bump to carry an already-reviewed, already-merged metadata change (#433) to the live registry; no new claim, no new code.
EVIDENCE: python tools/check-mcp-server.py and node --test both clean; registry read-back planned post-merge, not assumed.