chore: bump transitive deps for security (fast-uri, hono, @hono/node-server, dompurify)

Resolves 7 Dependabot alerts via pnpm.overrides (all transitive, no root
package changes). MCP SDK 1.29.0 is already latest, so overrides are the
only lever.

- fast-uri  >=3.1.4 <4   (#55/#53, high — via @modelcontextprotocol/sdk > ajv)
- hono      ^4.12.27     (#52/#51/#50, medium — bumps prior <4.12.25 override)
- @hono/node-server >=2.0.5 <3 (#49, medium — major bump; peer hono ^4 ok,
                                only loaded by the SDK's HTTP transport which
                                tapflow never uses — stdio only)
- dompurify >=3.4.12 <4  (#54, low — bumps prior <=3.4.10 override; docs devDep)

Resolved: fast-uri 3.1.4, hono 4.12.31, @hono/node-server 2.0.11, dompurify 3.4.12.
typecheck + mcp-server/flow-runner builds and tests green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: jo-duchan

package.json

@@ -46,9 +46,11 @@
     "overrides": {
       "shell-quote@<1.8.4": "^1.8.4",
       "esbuild@>=0.27.3 <0.28.1": ">=0.28.1",
-      "hono@<4.12.25": "^4.12.25",
+      "hono@<4.12.27": "^4.12.27",
+      "@hono/node-server@<2.0.5": ">=2.0.5 <3",
+      "fast-uri@<3.1.4": ">=3.1.4 <4",
       "undici@>=7.23.0 <7.28.0": ">=7.28.0 <8",
-      "dompurify@<=3.4.10": ">=3.4.11 <4",
+      "dompurify@<3.4.12": ">=3.4.12 <4",
       "js-yaml@<3.15.0": "^3.15.0",
       "js-yaml@>=4.0.0 <4.3.0": ">=4.3.0 <5",
       "axios@>=1.15.2 <1.18.0": ">=1.18.0 <2",