fix: update Hono and node-server security floors

[ryanduguid]

Summary

The unit workflow stops at the MCP audit because both package trees pin Hono 4.13.5. Update the existing overrides and locks to Hono 4.13.11 and resolve node-server 2.1.3, preserving SDK 1.30.0 and every unrelated package record.

Locked package	Before	After
Hono	4.13.5	4.13.11
@hono/node-server	2.0.12	2.1.3

These versions clear the verified conditions in GHSA-hxh3-vqpv-xpqv, GHSA-5r4p-p66f-jhc7 and GHSA-rmxm-3fg6-px4f. Application exploitability is unverified.

Evidence

• The unchanged standalone install reproduces the Hono advisory; the hosted unit job fails before Jest. The repaired root and standalone production audits report zero vulnerabilities.
• Complete lock comparisons retain all 681 root and 94 standalone records, with changes confined to Hono and node-server. Registry integrity and dependency ranges match. Both existing overrides are the only manifest changes.
• Node 26.10.0/npm 11.21.0: root installation, npm run test:mcp, packed installation and the defined CI unit/plugin subset pass: 77 suites, 883 tests passed and 2 skipped.
• Node 22.23.3/npm 11.21.0: the existing source and packed MCP checks pass. These cover startup, handshake, tool catalogue and unknown-tool handling.
• A separate fresh packed consumer resolves SDK 1.32.0, node-server 2.1.3 and Hono 4.13.12; its MCP smoke and production audit pass. All four retained jobs verify 239 source hashes before and after execution.
• The dependency repair combined with transcript PR 3 passes the same unit/plugin subset: 78 suites, 887 tests passed and 2 skipped. Both 240-file guards pass. The combined tree has no conflicts and retains all six tested file hashes.
• Hosted Node 24 build, standalone MCP verification/audit and Jest pass at this exact head. Linux and Windows browser E2E, SonarCloud, Codacy, Graphite and Windows cleanup also pass.
• Aikido reports zero issues across seven named inputs and an empty dependency result. The newer repository advisories are checked separately because npm audit does not report them.

Merge danger

Door: two-way. Blast radius: MCP dependencies.

The upstream security releases reject paths retaining a percent sign after decoding. No application serveStatic use was identified, but that compatibility surface remains untested.

Unverified

Full local npm test, browser E2E and live YouTube; Node 22 unit/native coverage; MCP tool execution, REST and authentication forwarding; application exploitability and the inherited caption-fetch SSRF assessment. Root overrides are not inherited by packed consumers, so future consumer resolutions are not pinned by this change. Default-branch provider closure is unverified.