fix(deps): bump fast-uri (HIGH CVE) + document get_aba_session_tracker (#9)

npm audit fix bumped fast-uri from <=3.1.1, clearing two HIGH
advisories (GHSA-q3j6-qgpj-74h6 path-traversal + GHSA-v39h-62p7-jpjc
host-confusion). Transitive through @modelcontextprotocol/sdk → ajv.
Build + 9 tests pass.

Also documented get_aba_session_tracker in README (Specialty
workflows). Implementation already existed; just missing from the
public tool table.

upstream-mcp now has 0 npm audit findings.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: byteworthy

README.md

@@ -117,6 +117,7 @@ Free API key (500 calls per month, no credit card): [upstream.cx/developers/keys
 | Tool | Tier | What it does |
 |---|---|---|
 | `get_authorization_status` | `[Paid]` | Authorization state for a patient. Hours or units authorized, used, remaining, expiry date, and renewal urgency (red, amber, green). Routes per specialty (ABA session units, SNF stay days, dental procedure caps, PT/OT visit limits, imaging procedure approvals, dialysis treatment authorizations). |
+| `get_aba_session_tracker` | `[Paid]` | ABA session authorization status by patient reference: authorized hours, sessions used, hours remaining, expiry date, risk level (red / amber / green), renewal urgency. Use in ABA billing workflows. Patient reference is the anonymized token from your Upstream dashboard — never PHI. |
 | `get_patient_propensity` | `[Paid]` | Patient collectibility score from 0 to 100 with collection probability and recommended approach. Powered by Upstream's propensity model. |
 
 ---