chore(deps): upgrade server and MCP runtime (#1570)

## Description

Upgrade the server and MCP runtime dependency set within existing major versions: Hono, the Hono Node adapter, MCP SDK, Express rate limiting, Zod, Clack prompts, Bonjour, and DOMPurify. Refresh stale transitive security pins for Hono, the Hono Node adapter, `fast-uri`, `body-parser`, and `ip-address`.

The `ip-address` override update fixes an IPv6 loopback failure exposed by express-rate-limit 8.7.0. DOMPurify 3.4.14 fixes its UI sanitization advisories, and protobufjs 7.6.6 fixes its parser denial-of-service advisory. The remaining production-audit finding is Sharp through frozen `@xenova/transformers`; the measured Transformers.js v4 migration is tracked separately in `codemem-jnd6.8` because repository overrides do not protect published consumers.

## Type of Change

- [ ] 🚀 Feature (new functionality)
- [ ] 🐛 Bug fix (fixes an issue)
- [ ] 📚 Documentation (docs-only change)
- [x] 🔧 Maintenance (refactor, chore, CI, etc.)
- [ ] 🧪 Testing (test-only changes)

## Testing

- [x] Relevant checks pass locally (`pnpm run tsc`, `pnpm run lint`, `pnpm run test`)
- [ ] Added/updated tests for changes
- [x] Manually verified changes work as expected

Additional validation:
- `pnpm run build`
- `pnpm --filter codemem test:packed-artifact`
- `pnpm exec vitest run packages/mcp-server/src/http.test.ts`
- `pnpm --filter @codemem/ui test`
- `pnpm --filter @codemem/ui build`
- `pnpm audit --prod --json`
- Local Snyk SCA: 0 issues

Known existing issue: `pnpm audit --prod` reports GHSA-f88m-g3jw-g9cj through `@xenova/transformers>sharp`; the v4 migration and packaging evaluation are deferred to `codemem-jnd6.8`.

## Checklist

- [x] Code follows project style (`pnpm run lint` passes for touched files)
- [x] Self-review completed
- [x] Documentation updated (not needed; no user-facing behavior changed)
- [x] No new warnings introduced