fix: update hono 4.7.6→4.12.6, @hono/node-server 1.14.1→1.19.10, override tar/serialize-javascript

Resolves 6 high audit vulnerabilities (Hono auth bypass, serveStatic, JWK confusion,
node-tar symlink traversal, serialize-javascript RCE).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

package.json

@@ -13,6 +13,12 @@
     "seed": "pnpm --filter server seed",
     "test:e2e": "playwright test --config e2e/playwright.config.ts"
   },
+  "pnpm": {
+    "overrides": {
+      "tar": ">=7.5.11",
+      "serialize-javascript": ">=7.0.3"
+    }
+  },
   "devDependencies": {
     "@playwright/test": "1.58.2",
     "@typescript-eslint/eslint-plugin": "8.56.1",