chore(deps): resolve 7 open Dependabot alerts via npm overrides (#8067)

- fast-uri ^3.1.3 (root + electron) — host confusion via IDN (#131/#126, high)
- hono ^4.12.27 — JSX ctx isolation / cx() XSS / v1 adapter req drop (#128/#129/#130, medium)
- @hono/node-server ^2.0.5 — serve-static path traversal (#127, medium); MCP uses only getRequestListener, not serve-static
- body-parser ^2.3.0 — DoS on invalid limit (#125, low)

Resolved: fast-uri 3.1.4, hono 4.12.31, @hono/node-server 2.0.11, body-parser 2.3.0. All clear in npm audit; lockfile-lint OK.

package.json

@@ -389,7 +389,10 @@
     "vite": "^8.0.16",
     "protobufjs": "^7.6.3",
     "@babel/core": "^7.29.6",
-    "hono": "^4.12.25",
+    "hono": "^4.12.27",
+    "@hono/node-server": "^2.0.5",
+    "fast-uri": "^3.1.3",
+    "body-parser": "^2.3.0",
     "@yarnpkg/parsers": {
       "js-yaml": "^4.2.0"
     },