Fix inserted-count log, clear npm audit findings, add integration source tag

[jennapederson]

Summary

• Bug fix: npm run index's final Inserted N documents into index ... log read progressBar.getTotal(), but cli-progress's SingleBar.start() silently no-ops whenever stdout isn't a TTY (any piped/redirected/CI run), so total never gets set and the message falls back to the library's constructor default of 100 regardless of how many documents were actually indexed. Reproduced: reported "Inserted 100 documents" for a 10-row dataset. Fixed by reporting clean.length directly instead of relying on the progress bar's internal state.
• Dependency fix: npm audit fix --force's only proposed fix was downgrading @huggingface/transformers 4.2.0 → 3.8.1 (a SemVer major regression), and it still left the adm-zip advisory open (same root cause as semantic-search-example: onnxruntime-node's install script pins adm-zip@^0.5.16 even in its latest release). Override adm-zip to ^0.6.0 instead, which clears all findings without touching the transformers version the app actually depends on. 3 findings → 0.
• Add a sourceTag to the new Pinecone(...) calls in src/index.ts and src/recommend.ts so usage from this sample app is attributed per Pinecone's integration docs.

Test plan

• npm run typecheck
• Full test suite (npm test, 23 tests) passes
• Manually re-ran npm run index + npm run recommend end-to-end against a scratch index, confirming both the fixed count and correct recommendations

---

Note

Low Risk
Sample-app dependency and client configuration only; no auth logic or production data-path changes beyond using the existing env API key explicitly.

Overview
Adds an adm-zip npm override (^0.6.0) so transitive installs (e.g. from onnxruntime-node) pick up the patched version without downgrading @huggingface/transformers; package-lock.json updates accordingly.

Pinecone client setup in src/index.ts and src/recommend.ts now passes apiKey from PINECONE_API_KEY and a sourceTag (pinecone:recommender_example_typescript) on new Pinecone(...) for integration attribution.

^{Reviewed by Cursor Bugbot for commit ff55f50. Bugbot is set up for automated code reviews on this repo. Configure here.}