chore(deps): patch hono, and drop two overrides that pinned nothing (#380)

Audited all 13 root overrides against what the lockfile actually
resolves, after finding that the Desktop runtime had never had any of
them (#376). Three results.

`hono` was pinned `^4.13.0` and resolving to 4.13.1, which is inside the
advisory range for both the `toSSG()` write and the query-parser issue
(fixed in 4.13.5). Pinned `^4.13.5`; it resolves to 4.13.7. Three lines
of lockfile.

`basic-ftp` and `jayson > uuid` pin nothing — none of `basic-ftp`,
`jayson` or `uuid` is in the tree at all. They are leftovers from
dependencies that have since gone, and an override that matches nothing
is worse than no override: it reads as protection. Removed, with no
change to any resolution.

The other nine are doing their job: axios 1.19.0, undici 8.10.0, ws
8.21.3, postcss 8.5.26, esbuild 0.28.1, brace-expansion 5.0.9, fast-uri
3.1.5, tar 7.5.22, ip-address 10.4.0 — one copy each.

NOT bumped: vitest `^4.1.3` (resolves 4.1.10) against the @vitest/mocker
path-traversal advisory, fixed in 4.1.11. Every route to it —
`vitest@^4.1.11`, `vitest@4.1.11` exact — crashes Arborist in
`#loadPeerSet` with "Cannot read properties of null (reading
'edgesOut')", the same failure as #373, and retrying does not clear it;
unmodified main resolves fine. vitest declares exact-version peers on a
dozen optional `@vitest/*` packages, which is the likely trigger. It is
development scope and not shipped, so it is not worth a hand-edited
lockfile on a package that publishes real-money code. Left for when npm
or vitest moves.

Verified by clean `npm ci` from this lockfile in a scratch tree:
hono 4.13.7, tsc clean, 1088 tests pass.


Claude-Session: https://claude.ai/code/session_015mUab3xrLHNpYqVHJLgJHL

Co-authored-by: 1bcMax <viewitter@gmail.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: 3 people

package-lock.json

@@ -129,19 +129,15 @@
   "overrides": {
     "axios": "$axios",
     "undici": "$undici",
-    "basic-ftp": "^5.3.1",
     "ws": "^8.21.2",
     "postcss": "^8.5.25",
     "esbuild": "^0.28.1",
     "brace-expansion": "^5.0.9",
     "fast-uri": "^3.1.5",
     "tar": "^7.5.22",
-    "hono": "^4.13.0",
+    "hono": "^4.13.5",
     "@hono/node-server": "^2.1.0",
-    "ip-address": "^10.4.0",
-    "jayson": {
-      "uuid": "^11.1.1"
-    }
+    "ip-address": "^10.4.0"
   },
   "engines": {
     "node": ">=22"