Release v2.0.1 — Clear transitive CVE backlog · lazyants/hetzner-mcp-server

Catch-up release matching lexware-mcp-server v2.0.1 and transkribus-mcp-server v2.0.1.

What's new

This is a security-hygiene release. No code changes; no tool additions.

npm overrides block added to clear transitive CVE backlog:
- `fast-uri ^3.1.2` — clears GHSA-q3j6-qgpj-74h6 (path traversal, HIGH) + GHSA-v39h-62p7-jpjc (host confusion, HIGH).
- `brace-expansion ^5.0.6` — clears GHSA-jxxr-4gwj-5jf2 (large-numeric-range DoS, moderate).
- `hono ^4.12.21` — clears GHSA-qp7p-654g-cw7p (JSX CSS injection), GHSA-hm8q-7f3q-5f36 (JWT NumericDate), GHSA-p77w-8qqv-26rm (Vary cache leak).
Hygiene baseline alignments since v2.0.0: ESLint 10 + cause-chaining, .nvmrc pinning, SECURITY.md disclaimer wording, version-check script cleanup.

All overrides target dev-transitive deps — no runtime impact on the published package surface.

```
npm view @lazyants/hetzner-mcp-server version # → 2.0.1
```