Address 6 project-wide SonarCloud findings on main

These predate PR #97 but surface in the project-wide issue list:

- 2 × python:S1192 in mcp_server/server.py: extracted _ERR_ACTIONS_LIST
  and _ERR_TEXT_STRING module constants (literal "'actions' must be a
  list" appeared 4x; "'text' must be a string" appeared 3x)
- python:S5869 in md_authoring/markdown_to_actions.py _TEMPLATE_RE:
  with re.IGNORECASE, [A-Za-z_] has a duplicate range — replaced with
  [A-Z_] (lowercase folds via the flag); dropped the misplaced NOSONAR
- python:S8513 in visual_review/review_server.py: collapsed
  `startswith("/img/baseline/") or startswith("/img/current/")` into
  the single-call tuple form
- python:S8520 in test_sharding.py: replaced `sum(parts, [])` flatten
  with `list(itertools.chain.from_iterable(parts))`
- text:S8565 in pyproject.toml (missing lock file): generated uv.lock
  via `uv lock` to pin all 26 transitive dependencies (project still
  builds with setuptools; uv.lock just documents resolved versions)

All 2920 unit tests pass.

Author: JE-Chen