Replace Express stack with Hono to minimize supply chain surface

Removes express, body-parser, cors, commander, and touch (130 transitive
packages) in favor of hono + @hono/node-server (zero transitive deps).
CLI parsing now uses node:util parseArgs, and touch replaced with fs.openSync.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: statico

package.json

@@ -10,12 +10,9 @@
   "license": "MIT",
   "private": true,
   "dependencies": {
-    "body-parser": "2.2.2",
-    "commander": "14.0.3",
-    "cors": "2.8.6",
-    "express": "5.2.1",
-    "papaparse": "5.5.3",
-    "touch": "3.1.1"
+    "@hono/node-server": "^1.14.1",
+    "hono": "^4.7.9",
+    "papaparse": "5.5.3"
   },
   "packageManager": "pnpm@10.33.0"
 }