fix(update): discard local package-lock.json before git pull, bump v0.4.9

npm install modifies package-lock.json on the server, causing
'git pull --ff-only' to abort with 'your local changes would be
overwritten'. Add 'git checkout -- package-lock.json' before the pull
so the generated lock file never blocks updates.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "nixpanel-server",
-  "version": "0.4.8",
+  "version": "0.4.9",
   "private": true,
   "workspaces": [
     "server",