chore: fix security vulnerabilities in dependencies (#488)

* chore: fix security vulnerabilities in dependencies

- Bump next 16.2.1 -> 16.2.3 (DoS via Server Components, GHSA-q4gf-8mx6-v5v3)
- Bump better-auth 1.5.6 -> 1.6.2 (prototype pollution in defu, removes vitest prod dep)
- Bump vite ^8.0.0 -> ^8.0.5 (fs.deny bypass, arbitrary file read, path traversal)
- Override hono >=4.12.12 (cookie validation, IP matching, path traversal, middleware bypass)
- Override @hono/node-server >=1.19.13 (middleware bypass via repeated slashes)
- Override defu >=6.1.5 (prototype pollution via __proto__ key)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: update pnpm-lock.yaml for security fixes

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: use caret ranges for security overrides

Constrain hono, @hono/node-server, and defu overrides to their
current major version to prevent unexpected major bumps.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: peppescg

package.json

@@ -52,15 +52,15 @@
     "ai-sdk-ollama": "^3.0.0",
     "ajv": "^8.17.1",
     "ajv-formats": "^3.0.1",
-    "better-auth": "1.5.6",
+    "better-auth": "1.6.2",
     "class-variance-authority": "0.7.1",
     "clsx": "2.1.1",
     "date-fns": "^4.1.0",
     "dexie": "^4.2.1",
     "lucide-react": "^0.577.0",
     "msw": "^2.12.2",
     "nanoid": "^5.1.6",
-    "next": "16.2.1",
+    "next": "16.2.3",
     "next-themes": "^0.4.6",
     "nuqs": "^2.8.1",
     "pg": "^8.13.3",
@@ -101,7 +101,7 @@
     "tailwindcss": "^4",
     "tsx": "4.21.0",
     "typescript": "^6.0.2",
-    "vite": "^8.0.0",
+    "vite": "^8.0.5",
     "vite-tsconfig-paths": "^6.0.0",
     "vitest": "^4.0.8",
     "vitest-fail-on-console": "^0.10.1"
@@ -116,7 +116,9 @@
       "express-rate-limit": ">=8.2.2",
       "lodash": ">=4.17.23",
       "lodash-es": ">=4.17.23",
-      "hono": "4.12.9",
+      "hono": "^4.12.12",
+      "@hono/node-server": "^1.19.13",
+      "defu": "^6.1.5",
       "rollup": ">=4.59.0",
       "undici": "7.24.6",
       "kysely": ">=0.28.14",