[chore]: patch worker and remotion dependency issues

[Caezarr]

🎯 Objective
Patch published dependency vulnerabilities in the Worker and Remotion packages, and restore a valid Remotion package set for local renders.

🔍 Problem Found

• worker/package.json:14-15 allowed hono to resolve below the patched range for four published advisories affecting Hono request handling and middleware behavior.
• remotion/package.json:16-33 let the marketing video package resolve vulnerable transitive esbuild and ws versions, and it declared zod ^4.4.3 even though Remotion currently expects 4.3.6 exactly. pnpm exec remotion compositions src/index.ts surfaced the version mismatch before Chrome download.

✅ Changes Made

• Bumped the Worker dependency range so hono resolves to 4.12.25 in worker/pnpm-lock.yaml.
• Added pnpm.overrides in remotion/package.json to force patched esbuild@0.28.1 and ws@8.20.1 across the Remotion dependency graph.
• Pinned @remotion/cli, @remotion/google-fonts, and remotion to the same exact 4.0.459 version to avoid future package drift.
• Pinned zod to 4.3.6, matching Remotion's expected version and removing the CLI compatibility warning.

🧪 How to Test

1. cd worker && pnpm typecheck && pnpm audit --prod
2. cd remotion && pnpm lint && pnpm audit --prod
3. cd remotion && pnpm exec remotion versions --log=verbose
4. Optional sanity checks already run during audit: cd landing && pnpm build, pnpm typecheck, pnpm build, and cargo test from the desktop app surfaces.

⚠️ Breaking Changes
None expected. This is a dependency-only patch plus exact-version alignment for Remotion.

📎 References

• GHSA-xrhx-7g5j-rcj5
• GHSA-3hrh-pfw6-9m5x
• GHSA-f577-qrjj-4474
• GHSA-2gcr-mfcq-wcc3
• GHSA-gv7w-rqvm-qjhr
• GHSA-58qx-3vcg-4xpx