chore(deps): consolidate Dependabot PRs #125–#147 (latest compatible)

[pacphi]

Summary

Consolidates all 19 open Dependabot PRs onto a single branch. Per the
no-downgrade policy, each dependency is resolved to the latest compatible
release rather than the version the individual PR pinned — several PR targets
were already stale and are superseded here (noted with ⬆️).

This supersedes and closes every PR listed below.

Frontend (pnpm)

Dependency	Applied	PR	Note
vitest	4.1.8	#127	⬆️ target 4.1.7
@storybook/react, storybook	10.4.2	#128	⬆️ target 10.4.1
eslint	10.4.1	#139
typescript-eslint	8.61.0	#139	⬆️ target 8.60.1
idb-keyval	6.2.5	#140
vite	8.0.16	#141
date-fns	4.4.0	#142
turbo	2.9.16	#143
@tanstack/react-query	5.101.0	#144
@tanstack/react-router	1.170.15	#144	⬆️ target 1.170.11
@tanstack/react-virtual	3.14.2	#144
react-dom (+ react)	19.2.7	#145	react bumped to satisfy peer
zustand	5.0.14	#146

Backend (Cargo)

Dependency	Applied	PR	Note
openssl	0.10.80	#125
serde_json	1.0.150	#132
axum-test	20.1.0	#133
redis	1.2.2	#134
sqlx	0.9.0	#135	breaking — see below
fastembed	5.16.0	#136	⬆️ target 5.15.0
uuid	1.23.2	#137
llama-cpp-4	0.3.1	#138	⬆️ target 0.3.0

Rust toolchain

• Docker base image rust:1.95-slim → rust:1.96-slim (deps(docker)(deps): bump rust from 1.95-slim to 1.96-slim in /backend #147)
• Aligned rust-toolchain.toml channel and Cargo.toml MSRV to 1.96.0, plus
  docker-compose.yml RUST_VERSION and the setup / deployment / maintainer /
  README docs. (CI uses dtolnay/rust-toolchain@stable and node-version: 26,
  which already track these.)

Breaking change handled: sqlx 0.8 → 0.9

sqlx 0.9 implements SqlSafeStr only for &'static str; runtime-built query
strings now require an explicit safety assertion. Rather than scatter
sqlx::AssertSqlSafe(...) across ~20 call sites, this adds a single audited
choke point — db::audited_sql() — with one authoritative doc comment
explaining the injection-safety invariant, and routes all dynamic-SQL sites
through it (vectors, api, cleanup, mcp, main, integration tests).
Every such string is composed only from string literals and bind-parameter
markers (? / ?N); all values are passed through .bind(...).

Verification

• Backend: cargo build --all-targets, 1900+ tests pass, clippy (strict, -D warnings), cargo fmt --check
• Frontend: turbo typecheck, turbo build, turbo test (271 tests), eslint, prettier --check
• Docs: markdownlint, yamllint, prettier, internal link check (0 errors)

Closes

Closes #125, #127, #128, #132, #133, #134, #135, #136, #137, #138, #139, #140, #141, #142, #143, #144, #145, #146, #147

[pacphi]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.