Cut over to Hono and delete Express

The final swap once every route is ported and tests pass against the new app.

• Entry point boots the Hono server instead of Express
• Deploy to staging, smoke the whole app (public pages, admin login, review create/edit, bookmarks, image jobs, stats), then prod
• Remove express, cors, cookie-parser, helmet, socket.io and their @types from package.json
• Delete the Express app, middleware and route files