chore(deps): security bumps hono 4.13.7, astro 7.3.2, js-yaml 4.3.2 + cloudflare adapter 14.3.1

[bighadj22]

Replaces #122 (same bumps, plus a required adapter fix — see below).

Security context

• hono 4.13.3 → 4.13.7: 4 advisories — XSS in hono/jsx boundary components (GHSA-hxh3-vqpv-xpqv), query-parser fragment differential (GHSA-crvj-82cr-hjcx), toSSG() path traversal (GHSA-gqvv-2mrq-wpjv), parseBody() memory exhaustion (GHSA-g6gw-c38x-mqfc)
• js-yaml 4.3.1 → 4.3.2: security backport (merge-sequence CPU limits)
• astro 7.2.4 → 7.3.2: MDX <script>/<style> escaping fix + Cloudflare adapter dev-session fix + i18n fallback routing fix

Why #122 was not merged as-is

#122 bumps astro to 7.3.2 but keeps @astrojs/cloudflare 14.2.x, which still imports beginContentEntryCollection — an export removed in astro 7.3. Both astro builds (dashboard + theme01) fail with MISSING_EXPORT. CI does not run builds, so #122 looked green while breaking production builds. This PR pairs astro 7.3.2 with @astrojs/cloudflare 14.3.1, which fixes that import.

Checks

• Root Vite pin untouched — still a single vite@8.2.2 (no dual-Vite boot crash)
• react 19.3.0 from chore(deps): bump react and react-dom to 19.3.0 with root lockfile sync #123 preserved

Verification (run locally on this exact tree)

• cod-server: tsc clean, 2066/2066 tests (hono 4.13.7)
• cod-client-astro: typecheck 0 errors, 147/147 tests, astro build succeeds
• theme01: astro check 0 errors, 21/21 tests, validate:all fully compliant, astro build succeeds