deps: bump hono to >=4.12.34 (CVE-2026-69207, CORS ReDoS)

[pcornelissen]

What & why

hono 4.12.30 is affected by CVE-2026-69207 / GHSA-8j4g-w8fx-2239 (ReDoS in
the CORS middleware via Access-Control-Request-Headers), fixed in 4.12.34.
The vulnerable path is reachable unauthenticated through the /.well-known/*
CORS block, which is the one cors() call in the repo without an explicit
allowHeaders. Details and reachability analysis are in #460.

Fixes #460

This PR:

• bumps hono to ^4.12.34 in apps/api and apps/proxy (pnpm resolves to 4.13.1)
• moves the pinned override @modelcontextprotocol/sdk>hono to 4.12.34, so the
  transitive copy is not left on the vulnerable version after a normal update
• sets an explicit allowHeaders on the /.well-known/* cors() block as
  defense in depth, so the reflect-and-parse path is not taken regardless of the
  hono version

How to test

• pnpm why hono shows no remaining 4.12.30 resolution
• pnpm typecheck passes
• pnpm lint passes

AI assistance

• Used AI for: locating the reachable cors() call and drafting this change,
  as part of the KIberblick OSS security service. The CVE match and the fix were
  verified by hand against pnpm-lock.yaml and the GHSA advisory.

Type of change

• Bug fix (non-breaking change that fixes an issue)

Checklist

• pnpm typecheck passes
• pnpm lint passes
• pnpm format has been run on changed files
• Added or updated tests where it makes sense
• Branch is up to date with main
• PR title follows the area-prefix style for the area being changed
• Read CONTRIBUTING.md (skim counts)

---

Summary by cubic

Upgrades hono to >=4.12.34 and hardens the /.well-known/* CORS config to address CVE-2026-69207 (CORS ReDoS). Removes the vulnerable version from direct and transitive installs and blocks the reflect-and-parse path.

• Dependencies

  • Bumped hono to ^4.12.34 in apps/api and apps/proxy.
  • Pinned @modelcontextprotocol/sdk>hono override to 4.12.34 to replace the transitive vulnerable copy.

• Bug Fixes

  • Added allowHeaders: ["Content-Type", "Authorization"] to the /.well-known/* cors() block for defense in depth.

^{Written for commit 3a4d2dc. Summary will update on new commits.}

[superlog-app]

Observability review

All clear — no observability concerns found.

This PR understood the assignment.

[cubic-dev-ai]

No issues found across 5 files

_{Re-trigger cubic}