Bring main's rc-series dependency bumps to v2/main (@hono/node-server 2.x, vite 8.1.5)

[cliffhall]

Sub-task of #1821, step 3 of the ordered plan in its description.

Why

The 2.0.0-rc series shipped dependency bumps that landed on main only, so v2/main develops against older versions and would otherwise meet them for the first time at the milestone merge.

Package	v2/main	main	Notes
@hono/node-server	^1.19.14	^2.0.12	Major. The web backend — the one real decision here
vite	^8.0.0 / ^8.0.16	^8.1.5	Security bumps (three dev-server file-read advisories, #1841)

Not in scope

• @modelcontextprotocol/sdk 1.29 → 1.30 is not ours. v2's direct SDK dependencies are the split packages, pinned exactly at 2.0.0-beta.5 (@modelcontextprotocol/{client,core,server,server-legacy}). The v1 SDK is present only as an auto-installed peer dependency of @modelcontextprotocol/ext-apps@1.7.4, which still declares "@modelcontextprotocol/sdk": "^1.29.0". Nothing in core/ or the clients imports it; the movement is a lockfile re-resolution within a caret range.
• @oxc-project/types likewise floats transitively under vite/rolldown.

Confidence

This exact dependency set already passed the full npm run ci gate locally (validate → coverage → verify:build-gate → smoke → Storybook) as part of the back-merge experiment in the now-closed #1868, and the auto-merged lockfiles were consistent — a follow-up npm install produced no changes. So this is re-verification, not new risk. Run the gate again anyway; a major bump on the web backend warrants it.

Follow-up worth noting

ext-apps keeping a v1-SDK peer means the v1 SDK stays in the tree — and in npm audit — until that package migrates to the split packages.

[cliffhall]

Closed by #1881, merged to v2/main. (Closing manually: Closes #N only auto-closes for PRs targeting the default branch, and v2 PRs target v2/main.)