deps(sqlite-vec): move the pin from 0.1.7-alpha.2 to the stable 0.1.9

[mrsibe]

What

Move the sqlite-vec pin from 0.1.7-alpha.2 to the stable 0.1.9.

This is the follow-up that docs/dependency-audit.md already recorded under the sqlite-vec verdict: the manifest sat on an alpha while a stable release existed upstream.

Why an exact pin, not ^0.1.9

Upstream is still pre-v1 and explicitly reserves the right to make breaking changes. ^0.1.9 resolves to 0.1.10-alpha.*, which introduces ANN / DiskANN / IVF work we have no reason to adopt implicitly. The pin is therefore exact, and 0.1.9 (not 0.1.10-alpha.4) is the target.

0.1.9 also fixes a vec0 metadata-text-column DELETE bug; vec0 brute-force search is unchanged and is still the right shape for a personal knowledge base.

Verification (Linux x64, WSL2)

Command	Result
npm run typecheck	clean
npm test	469/469 pass — includes the real-vec0 scope-filter tests (test/vectorFilter.test.ts runs the bundled extension under node:sqlite)
npm run build:unpack && npm run smoke:packaged	29 checks pass

From the packaged run:

[Database] Loading sqlite-vec from: .../app.asar.unpacked/node_modules/sqlite-vec-linux-x64/vec0.so
[Database] sqlite-vec version: v0.1.9
[SmokeTest] ok   sqlite-vec reports version v0.1.9
[SmokeTest] ok   sqlite-vec upsert + KNN query + delete round trip
[SmokeTest] ok   FTS5 is available and ranks: sqlite 3.53.2, ENABLE_FTS5 flag present

So the extension still loads from the unpacked path in the packaged app, and the vec0 lifecycle the store depends on is intact.

Docs

docs/dependency-audit.md is updated: the installed/ships-as/upstream rows, the "alpha question" paragraph, the follow-up marked done, and the recorded smoke-pass count corrected from a stale 20 to the current 29.

Not covered here

Only Linux x64 was exercised locally. The macOS/Windows packaged smoke is left to CI (verify.yml), which is exactly what the sqlite-vec-darwin-* / sqlite-vec-windows-x64 platform packages in the lockfile are for.

Rollback

Revert the single manifest line and regenerate the lockfile; the extension ships per-platform binaries and the SQLite schema is a vec0 table whose on-disk format is not changed by this bump. sqlite-vec 0.1.9 still reports the same vec0 capability set, so no re-index is needed.

Closes #62 follow-up.