fix: resolve open dependency vulnerabilities

[Helweg]

Summary

Resolves all 11 open Dependabot alerts and the full npm audit report (15 findings: 4 moderate, 11 high). After this change, npm audit reports 0 vulnerabilities.

Changes

All fixes are transitive dependency pins via overrides plus one dev-dependency bump:

Package	Change	Advisories
hono	4.12.27 → 4.12.34	CORS ReDoS (GHSA-8j4g-w8fx-2239)
ip-address	10.2.0 → 10.4.0	SSRF/trust-boundary bypasses (GHSA-mwp4-54f8-5fhr, GHSA-4xrf-jv44-h6hh, GHSA-22jq-vg5j-6vgg)
fast-uri	3.1.4 → 3.1.5	Host confusion via backslash authority (GHSA-7p8r-x3mc-p8w7)
postcss	8.5.18 → 8.5.26	sourceMappingURL map disclosure (GHSA-fxqj-rqcc-2cmp)
brace-expansion	5.0.8 → 5.0.9	DoS via unbounded expansion (GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895)
@eslint/config-array	0.21.2 → 0.23.5	minimatch-based DoS path
@earendil-works/pi-coding-agent	^0.82.0 → ^0.84.0	ships patched undici 8.9.0 (CRLF injection, cache parsing, cookie injection, retry desync)

Validation

• npm audit: 0 vulnerabilities
• npm run typecheck: pass
• npm run lint: pass
• npm run build:ts: pass (includes built-CLI smoke test)
• Test suite: 1361+ passing; the only local failures are load-sensitive watcher/metadata tests that time out at 30s on a heavily loaded machine (load avg 7-8) and pass in isolation. None touch the changed dependencies.