chore(deps): bump gitsheets to ^1.2.0

Updates the explicit range in apps/api/package.json to ^1.2.0 (was ^1.0.3,
which already permitted 1.x.y resolution but pinned the lockfile to a
specific 1.0.x build). Implicitly tested against 1.1.x and 1.2.x via npm
install resolution across every plan in this session — explicit bump lets
future readers see the intended floor.

What 1.0.5 / 1.1.0 / 1.2.0 added (release notes for context, no code
changes here):

- 1.0.5: PushDaemon non-FF detection + startup-backlog; Sheet.query
  AbortSignal support. Both are forward-useful but not yet wired into
  our codebase — tracked in #34 (AbortSignal) and #37 (startPushDaemon
  wiring with NFF discrimination).
- 1.1.0: Sheet.diffFrom, Sheet.attachments iterator + deleteAttachment,
  Repository.openSheet({prefix}), CLI buildout. The new attachment APIs
  matter for the deferred avatar route — tracked in #32.
- 1.2.0: Content-typed records (markdown + frontmatter), lazy body
  loading, pluggable format module. Tracked in #44 (broad migration)
  and #45 (blog-post revival).

`npm install` regenerates package-lock.json to pin gitsheets@1.2.0 and
its new transitives (rfc6902, csv-parse, csv-stringify, markdownlint).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: themightychris

apps/api/package.json

@@ -31,7 +31,7 @@
     "bcryptjs": "^3.0.3",
     "better-sqlite3": "^12.10.0",
     "fastify": "^5.8.5",
-    "gitsheets": "^1.0.3",
+    "gitsheets": "^1.2.0",
     "jose": "^6.2.3",
     "samlify": "^2.13.0",
     "uuidv7": "^1.2.1",