fix(deps): resolve Dependabot alerts for transitive deps

Clears all 14 open Dependabot alerts. All four flagged packages are
transitive deps pulled in via @modelcontextprotocol/sdk, fixed with
patch/minor bumps:

- fast-uri  3.1.0 -> 3.1.2  (high; via ajv)
- hono      4.12.12 -> 4.12.25 (medium/low; via @hono/node-server)
- qs        6.15.0 -> 6.15.2  (medium; via express/body-parser)
- ip-address 10.1.0 -> 10.1.1 (medium; via express-rate-limit)

fast-uri, hono and qs update cleanly via `npm update`. express-rate-limit
pins ip-address to exactly 10.1.0, so an `overrides` entry forces the
patched 10.1.1 (a patch release, API-compatible).

`npm audit` now reports 0 vulnerabilities; build passes.

Author: dcbouius

package-lock.json

@@ -22,6 +22,9 @@
     "release": "npm run build && npm publish"
   },
   "license": "ISC",
+  "overrides": {
+    "ip-address": "10.1.1"
+  },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@vectorize-io/vectorize-client": "^0.1.3",