chore(api): hono override pins 4.12.27, so the API ships known hono CVEs

[ggfevans]

Problem

api/package.json asks for hono: ^4.13.5 (bumped in #3249), but its overrides block still pins "hono": "^4.12.27". Bun applies the override, so api/bun.lock locks hono@4.12.27 and every API image ships 4.12.27. #3249 only changed the dependency spec line inside the lockfile; the resolved package never moved.

Evidence

• api/bun.lock at 466c49a: "hono": ["hono@4.12.27", ...], with overrides "hono": "^4.12.27".
• Trivy 0.70.0 against an API image built from main (run during chore(api): production image ships dev-only transitive dependencies #3205 verification, PR chore(api): ship only production dependencies in the API image (#3205) #3274): 6 MEDIUM and 1 LOW hono findings, fixed in 4.12.34 and 4.13.5. They sit below the HIGH/CRITICAL threshold, so neither the release gate nor code scanning surfaces them.
• The existing hono Dependabot alerts are all against the retired api/package-lock.json; none is open against api/bun.lock.

Fix

Raise the hono override to ^4.13.5 (or drop it if no transitive consumer still needs forcing), regenerate api/bun.lock, and confirm hono resolves to 4.13.5 or later. Audit the other overrides entries (@hono/node-server, defu, postcss) for the same stale-pin pattern.

Acceptance criteria

• api/bun.lock resolves hono 4.13.5 or later
• No overrides entry pins a package below its direct dependency range or below a known patched version
• API unit tests and the workers storage contract pass