fix(security): clear post-merge OSV advisories

New advisories landed after the integration work: fast-uri (High) and hono
(3x Medium) picked up fixed releases, and a Medium surfaced on
@hono/node-server. Bump the fast-uri and hono override pins to their fixed
patch releases (3.1.3, 4.12.27), clearing four findings.

The remaining @hono/node-server advisory is reachable only through the unused
@modelcontextprotocol/sdk transitive (no source imports it, no Hono server is
started); its only fix is a major bump the SDK pins against. Record that
assessment in .osv-scanner.toml so the scheduled scan stays honest instead of
alarming on an unreachable path.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.osv-scanner.toml

@@ -0,0 +1,15 @@
+# OSV-Scanner configuration.
+# Direct/transitive dependency versions are pinned to their fixed releases via
+# the `overrides` block in package.json; this file only records advisories we
+# have assessed as not-reachable or not-fixable without disproportionate risk.
+
+[[IgnoredVulns]]
+id = "GHSA-frvp-7c67-39w9"
+# @hono/node-server 1.19.x. Reachable only through @modelcontextprotocol/sdk,
+# which is an unused transitive dependency (no source file imports it) and never
+# starts a Hono HTTP server, so the advisory's request path is not exercised.
+# The only fix is @hono/node-server 2.0.5, a major bump the MCP SDK pins against
+# (^1.19.9); forcing it via override risks breaking the SDK at runtime for a
+# vulnerability we do not expose. Re-evaluate if the MCP SDK becomes a direct,
+# server-hosting dependency.
+reason = "Unreachable transitive (unused @modelcontextprotocol/sdk); fix requires a risky major override on a pinned peer dep."