fix: update hono 4.7.6→4.12.6, @hono/node-server 1.14.1→1.19.10, override tar/serialize-javascript

Resolves 6 high audit vulnerabilities (Hono auth bypass, serveStatic, JWK confusion,
node-tar symlink traversal, serialize-javascript RCE).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

package.json

@@ -13,6 +13,12 @@
     "seed": "pnpm --filter server seed",
     "test:e2e": "playwright test --config e2e/playwright.config.ts"
   },
+  "pnpm": {
+    "overrides": {
+      "tar": ">=7.5.11",
+      "serialize-javascript": ">=7.0.3"
+    }
+  },
   "devDependencies": {
     "@playwright/test": "1.58.2",
     "@typescript-eslint/eslint-plugin": "8.56.1",

server/package.json

@@ -12,12 +12,12 @@
   },
   "dependencies": {
     "@cashu/cashu-ts": "3.5.0",
-    "@hono/node-server": "1.14.1",
+    "@hono/node-server": "1.19.10",
     "better-sqlite3": "11.9.1",
     "chalk": "5.6.2",
     "dotenv": "17.3.1",
     "drizzle-orm": "0.40.1",
-    "hono": "4.7.6",
+    "hono": "4.12.6",
     "nanoid": "5.1.5",
     "nostr-tools": "2.23.3",
     "zod": "4.3.6"