Fix mergeProps dropping prototype shadowing keys

Server-side mergeProps was silently ignoring properties like `toString`, `valueOf`, and `hasOwnProperty` because it checked `key in target`, which walks the prototype chain. The fix uses `Object.prototype.hasOwnProperty.call()` to check only own properties, and explicitly guards against `__proto__` and `constructor` to match client-side behavior.