Sync bun.lock with package.json

The bun.lock that landed in #175 was stale — package.json bumped
homebridge to ^2.0.1 and typescript to ^6.0.3, but bun.lock still
pinned ^2.0.0-beta.70 and ^5.9.3. CI's `bun install --frozen-lockfile`
caught the divergence after the test workflow was added.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: kpsuperplane