fix(deps): remediate npm advisories

[ElbertePlinio]

Summary

• raise the existing fast-uri and hono overrides to patched releases
• lock both brace-expansion majors, ip-address, and nanoid to patched versions accepted by their parent ranges
• clear the 12 newly reported advisories without changing osv-scanner.toml

Validation

• pinned Bun 1.3.12 frozen install, typecheck, lint, and build pass
• CI: 1,133 tests passed, one skipped
• CI coverage: 82.48% lines
• OSV Scanner v2.3.8: no unfiltered issues
• gitleaks: pass

Review and risk

• local-review risk: serious backend/security
• three-profile dependency-security, correctness, and operational review completed
• targeted fix verification completed cleanly at ddbbebb; the later commit only records CI evidence
• no valid P0-P2 remains
• the pre-existing moderate @hono/node-server ignore has stale rationale; remediation remains tracked in Install the enforced TypeScript gate baseline #60 and is outside this six-package PR

Closes #66
Refs #65