Fix known vulnerabilities in hono, @hono/node-server, react-router, vite

Bumps four dependencies whose pinned versions are covered by published
security advisories:

- @hono/node-server 1.19.8 -> 1.19.17: authorization bypass for protected
  static paths via encoded slashes (GHSA-…, high), plus serveStatic
  middleware bypass via repeated slashes.
- hono 4.11.3 -> 4.13.0: arbitrary file access via serveStatic (high),
  CORS middleware reflecting any Origin with credentials when origin
  defaults to wildcard (high), and ReDoS in CORS middleware.
- react-router 7.12.0 -> 7.18.2: unauthenticated DoS via inefficient route
  matching (high) and DoS via unbounded path expansion in the __manifest
  endpoint (high).
- vite 7.3.1 -> 7.3.6: server.fs.deny bypass via queries and arbitrary
  file read through the dev server websocket (both high, dev-server only).

All bumps stay within the current major. `bun run build` passes.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FLKXKfBG82ynxV7K447UbQ

Author: claude

bun.lock

@@ -28,8 +28,8 @@
     "sync-web": "rm -rf web-dist && cp -r ../web/dist ./web-dist"
   },
   "dependencies": {
-    "@hono/node-server": "1.19.8",
-    "hono": "4.11.3",
+    "@hono/node-server": "1.19.17",
+    "hono": "4.13.0",
     "commander": "14.0.2"
   },
   "devDependencies": {

packages/server/package.json

@@ -12,7 +12,7 @@
     "browser-rpc": "workspace:*",
     "react": "19.2.3",
     "react-dom": "19.2.3",
-    "react-router": "7.12.0",
+    "react-router": "7.18.2",
     "@tanstack/react-query": "5.90.16",
     "wagmi": "3.3.2",
     "viem": "2.44.0",
@@ -28,6 +28,6 @@
     "@tailwindcss/vite": "4.1.18",
     "tailwindcss": "4.1.18",
     "typescript": "5.9.3",
-    "vite": "7.3.1"
+    "vite": "7.3.6"
   }
 }