fix: patch September security advisories

[kasperrt]

What changed

• update Hono to 4.13.5 to patch three request parsing and static-generation advisories
• update Vitest to 4.1.11 to patch the redirect-mock path traversal advisory
• require patched browserslist and baseline-browser-mapping transitive versions

Root cause and impact

The dependency graph still resolved versions affected by newly disclosed advisories, including Hono request parsing behavior reachable by the server. The updated direct dependencies and pnpm overrides remove all known audit findings.

Validation

• pnpm audit --audit-level low — no known vulnerabilities
• pnpm test — 5 tests pass
• pnpm lint:check — passes
• pnpm format:check — passes
• pnpm build — production client build passes
• pnpm build:check — client and server TypeScript checks pass after route generation