security(deps): bump hono to 4.12.14 and vite override to ^7.3.2 (#392)

Resolves all open Dependabot alerts on package-lock.json:

- hono <4.12.14: JSX SSR HTML injection, cookie name bypass, IPv4-mapped IPv6 ipRestriction, setCookie validation, serveStatic repeated-slash bypass, toSSG path traversal (alerts #16, #18, #20, #22, #24, #26)

- vite <7.3.2: dev server WebSocket arbitrary file read, optimized deps .map path traversal, server.fs.deny query bypass (alerts #12, #13, #14)

Lockfile refreshed via npm install --package-lock-only. Typecheck, lint, and 3418/3418 tests pass.

Author: ndycode

package-lock.json

@@ -154,17 +154,17 @@
 	"dependencies": {
 		"@codex-ai/plugin": "file:vendor/codex-ai-plugin",
 		"@openauthjs/openauth": "^0.4.3",
-		"hono": "4.12.10",
+		"hono": "4.12.14",
 		"undici": "^6.24.1",
 		"zod": "^4.3.6"
 	},
 	"overrides": {
-		"hono": "4.12.10",
+		"hono": "4.12.14",
 		"flatted": "3.4.2",
 		"minimatch": "10.2.4",
 		"picomatch": "4.0.4",
 		"rollup": "4.59.0",
-		"vite": "^7.3.1",
+		"vite": "^7.3.2",
 		"micromatch": {
 			"picomatch": "2.3.2"
 		},