fix(deps): clear remaining npm audit advisories (#2075)

Adds overrides for the five advisories present in the production
dependency tree, plus two dev-only stragglers, bringing `npm audit`
to zero.

Only ip-address is meaningfully reachable: server/src/index.ts builds
sandboxRateLimiter from express-rate-limit, which parses IPs via
Address6 for subnet keying. Impact here is a rate-limit key bypass on
/sandbox rather than the SSRF the advisory titles imply, since req.ip
derives from the socket and the proxy binds localhost.

The other four are installed but unexercised: hono middleware is never
wired up, @hono/node-server's serve-static is never imported (only
getRequestListener), fast-uri is reached only for ajv format checks
whose result is never trusted for a host decision, and brace-expansion
expands serve-handler's config-supplied pattern rather than the
attacker-supplied path. nanoid and postcss are dev-only.

Every patched release exists within the current major line.
@hono/node-server is deliberately held at 1.19.17 rather than 2.x — a
major bump has no place on a deprecated branch.

Lock entries are patched in place rather than re-resolved, keeping the
diff to the affected packages.

Fixes #2074


Claude-Session: https://claude.ai/code/session_01Gq5jMmxRUphrVbfNbYVmQH

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: cliffhall

package-lock.json

@@ -81,13 +81,20 @@
   "overrides": {
     "get-intrinsic": "1.3.0",
     "shell-quote": "^1.8.4",
-    "hono": "^4.12.25",
+    "hono": "^4.13.3",
     "form-data": "^4.0.6",
     "@babel/core@<=7.29.0": "^7.29.6",
     "esbuild@<0.28.1": "^0.28.1",
     "minimatch@<3.1.4": "3.1.5",
     "js-yaml@<4": "3.15.1",
-    "js-yaml@>=4": "4.3.1"
+    "js-yaml@>=4": "4.3.1",
+    "@hono/node-server@<1.19.15": "^1.19.15",
+    "ip-address@<=10.3.0": "^10.5.0",
+    "fast-uri@<3.1.5": "^3.1.5",
+    "brace-expansion@<2": "^1.1.18",
+    "brace-expansion@>=4": "^5.0.9",
+    "nanoid@<3.3.18": "^3.3.18",
+    "postcss@<=8.5.22": "^8.5.26"
   },
   "engines": {
     "node": ">=22.7.5"