fix: Stabilize flaky lease renewer test and patch security vulnerabilities (#1640)

* fix: Widen goroutine margin in lease renewer idempotency test

TestLeaseRenewer_StartIsIdempotent failed in nightly CI with goroutine
count 7 vs expected max 6 (initial + 2). runtime.NumGoroutine() includes
all process goroutines (GC, timers, other tests), making a tight margin
fragile on busy CI runners.

Widen from +2 to +5 to absorb runtime jitter while still detecting a
real goroutine leak (3 unguarded Start() calls would add +3).

* fix: Patch hono and express-rate-limit security vulnerabilities

- hono: Update to 4.12.7 (from 4.12.5) to fix prototype pollution via
  __proto__ key in parseBody({ dot: true }) (GHSA-v8w9-8mx6-g223)
- express-rate-limit: Update to 8.3.1 (from 8.2.x) to fix IPv4-mapped
  IPv6 address bypass of per-client rate limiting (GHSA-46wh-pxpv-q5gq)

* fix: Use await polling instead of widened goroutine margin

Replace the point-in-time goroutine count check with await polling,
matching the pattern already used by TestLeaseRenewer_NoGoroutineLeak
in the same file. This tolerates transient runtime jitter while keeping
the assertion tight enough (+2) to detect the target bug.

---------

Co-authored-by: Ben Coombs <bjcoombs@users.noreply.github.com>

Author: bjcoombs

frontend/package-lock.json

@@ -374,12 +374,16 @@ func TestLeaseRenewer_StartIsIdempotent(t *testing.T) {
 	renewer.Start(ctx) // Should be ignored
 	renewer.Start(ctx) // Should be ignored
 
-	// Wait a bit for goroutine to start
-	time.Sleep(100 * time.Millisecond)
-
-	// Should only have started one goroutine
-	currentGoroutines := runtime.NumGoroutine()
-	assert.LessOrEqual(t, currentGoroutines, initialGoroutines+2, "Multiple Start() calls should not spawn multiple goroutines")
+	// Poll until goroutine count settles. Using await tolerates transient
+	// runtime jitter (GC, timers, concurrent tests) while still catching a
+	// real leak — 3 unguarded Start() calls would add +3, exceeding +2.
+	err = await.New().
+		AtMost(1 * time.Second).
+		PollInterval(50 * time.Millisecond).
+		Until(func() bool {
+			return runtime.NumGoroutine() <= initialGoroutines+2
+		})
+	assert.NoError(t, err, "Multiple Start() calls should not spawn multiple goroutines")
 
 	renewer.Stop()
 }