chore(deps): refresh transitive deps to clear npm audit

[htcom-code]

Problem

npm audit on main reports 5 advisories (2 high, 3 moderate). All of them
are reached through a single chain — the shadcn CLI dependency tree:

Package	Severity	Path
@hono/node-server <2.0.5 — serve-static path traversal (Windows)	moderate	shadcn → sdk
@modelcontextprotocol/sdk 1.25.0–1.29.0	moderate	shadcn
hono <4.12.34 — CORS ReDoS	moderate	shadcn → sdk
fast-uri 3.0.0–3.1.4 — host confusion	high	shadcn → sdk → ajv
brace-expansion 4.0.0–5.0.8 — DoS	high	shadcn → ts-morph → minimatch

Previously there was no clean remediation: the fix had to land upstream first
(hono → MCP SDK → shadcn), and npm audit fix --force only offered a major
shadcn downgrade. shadcn cannot be dropped — src/index.css imports
shadcn/tailwind.css as a build-time CSS source.

What changed

Upstream is now fixed. @modelcontextprotocol/sdk@1.30.0 widened its range to
"@hono/node-server": "^1.19.9 || ^2.0.5", which makes the patched 2.x line
reachable. That unblocks a plain lockfile refresh:

@modelcontextprotocol/sdk  1.29.0  -> 1.30.0
@hono/node-server          1.19.15 -> 2.1.0
hono                       4.12.32 -> 4.13.0
fast-uri                   3.1.4   -> 3.1.5
brace-expansion            5.0.8   -> 5.0.9

• package-lock.json only — package.json is untouched
• no overrides, no forced majors, no downgrades
• all five are transitive dev-tooling deps; none reach the shipped bundle

Verification

• npm audit → found 0 vulnerabilities (was 5)
• npm ci clean
• npm run lint → no errors (3 pre-existing only-export-components warnings unchanged)
• npm run build → passes

Notes

Independent of the open dependabot PRs (#28, #29) — this touches only
transitive lockfile entries, so it applies with or without them. Whichever
merges second will need a trivial lockfile rebase.