fix: update hono 4.7.6→4.12.6, @hono/node-server 1.14.1→1.19.10, override tar/serialize-javascript

Resolves 6 high audit vulnerabilities (Hono auth bypass, serveStatic, JWK confusion,
node-tar symlink traversal, serialize-javascript RCE).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/package.json

@@ -12,12 +12,12 @@
   },
   "dependencies": {
     "@cashu/cashu-ts": "3.5.0",
-    "@hono/node-server": "1.14.1",
+    "@hono/node-server": "1.19.10",
     "better-sqlite3": "11.9.1",
     "chalk": "5.6.2",
     "dotenv": "17.3.1",
     "drizzle-orm": "0.40.1",
-    "hono": "4.7.6",
+    "hono": "4.12.6",
     "nanoid": "5.1.5",
     "nostr-tools": "2.23.3",
     "zod": "4.3.6"