chore(deps): batch low-risk dependabot bumps (#828)

Bundles 9 dependabot PRs into a single update:

- hono 4.12.12 → 4.12.18 (root, packages/core, packages/stats, my-sonicjs-app) — supersedes #797, #798, #820
- next ^16 → ^16.2.3 (www) — supersedes #782
- axios 1.15.0 → 1.16.0 (packages/stats, transitive) — supersedes #821
- follow-redirects 1.15.11 → 1.16.0 (packages/stats, transitive) — supersedes #790
- fast-xml-builder 1.1.4 → 1.2.0 (root, transitive) — supersedes #826
- fast-xml-parser & @aws-sdk/xml-builder bumps (root, transitive) — supersedes #806
- postcss 8.5.6 → 8.5.14 (my-sonicjs-app, transitive) — supersedes #813

Verified locally:
- npm run build:core (clean)
- npm run type-check (clean)
- npm test (1477 passed, 328 skipped)

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

Author: lane711

my-sonicjs-app/package.json

@@ -30,7 +30,7 @@
     "@types/node": "^20.19.1",
     "drizzle-kit": "^0.30.0",
     "drizzle-orm": "^0.45.2",
-    "hono": "^4.12.12",
+    "hono": "^4.12.18",
     "typescript": "^5.8.3",
     "vitest": "^2.1.8",
     "wrangler": "^4.65.0",