build(deps): override hono and picomatch to clear transitive advisories

Pin hono to >=4.12.25 (GHSA-88fw-hqm2-52qc, CORS middleware reflects
any Origin) and picomatch to >=4.0.4 (CVE-2026-33671, ReDoS) through
pnpm overrides scoped to the vulnerable ranges. Both are build- and
dev-tooling transitives — hono via Prisma's dev tooling and the shadcn
CLI, picomatch via the build chain — and neither is on a runtime path:
the app is Next.js and sets no CORS headers. The prod audit drops from
one high to zero.

package.json

@@ -128,6 +128,10 @@
     "onlyBuiltDependencies": [
       "prisma",
       "@prisma/engines"
-    ]
+    ],
+    "overrides": {
+      "hono@<4.12.25": "^4.12.25",
+      "picomatch@<4.0.4": "^4.0.4"
+    }
   }
 }