chore(security): npm audit fix — patch hono advisory (lockfile only) (#54)

A new high-severity hono advisory (path traversal / CORS / cookie handling)
landed after the last fix. hono is transitive via @modelcontextprotocol/sdk's
HTTP stack; token-pilot speaks stdio so the path is unreachable, but the bump
clears the audit gate and dependabot. Lockfile only — no shipped/package change.

Co-authored-by: shahinyanm <mher.shahinyan@12go.asia>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: 3 people