fix(deps): bump rustls to 0.23.45 for RUSTSEC-2026-0285

[QuicksilverSlick]

Why

Security Domain / Security has failed on every main commit (49850a9, 36e4d19, 6bf3f0f). The job runs cargo-deny check against the root Cargo.lock, and cargo-deny reports RUSTSEC-2026-0285 (GHSA-2mjx-qc3c-rqvc). The advisory says rustls 0.23.42 accepts TLS 1.3 handshake messages across encryption-level boundaries. The fix is in rustls >= 0.23.45.

The failure started with the new advisory, not with a code change. No recent merge touched a dependency file.

What

cargo update -p rustls --precise 0.23.45, run in both workspaces:

crate	root Cargo.lock	desktop/src-tauri/Cargo.lock
rustls	0.23.42 → 0.23.45	0.23.42 → 0.23.45
rustls-webpki	0.103.13 → 0.103.15	0.103.13 → 0.103.15
aws-lc-rs	1.17.0 → 1.18.1	1.17.1 → 1.18.1
aws-lc-sys	0.41.0 → 0.45.0	0.42.0 → 0.45.0

Upstream block/buzz now locks these same versions. It got them as a side effect of block#7646 (7c789de), an iOS simulator build fix that also changes the Podfile, pubspec and a CI job, so I didn't cherry-pick that commit.

Neither lockfile gains or loses a package (1043 and 1231 before and after). Cargo also re-pointed a few range dependencies at versions already in the lock (data-encoding-macro-internal → syn 1.0.109, which upstream's lock also has; some desktop windows-sys edges 0.52 → 0.59).

CI: Desktop E2E Relay timeout 30 → 45 min

This PR's first CI run cancelled Relay Artifact Producer / Desktop E2E Relay at its 30-minute limit, and it wasn't a test failure. The relay-artifacts cache only hits on an exact key that includes Cargo.lock, and PR runs only read sccache. So after this bump the relay build (7m21s) and both nextest archive steps compile from source, and the job ran out of time while still archiving backend tests. The first push build on main after merge has the same cold start. Upstream block/buzz raised this timeout from 30 to 45 minutes in block#7620 (4d08194), a day after its own rustls bump; the second commit makes the same one-line change.

Checks

• cargo metadata --locked passes in both workspaces.
• Local cargo-deny check result: see the comment below.

🤖 Generated with Claude Code

[QuicksilverSlick]

Local cargo-deny check with the version CI uses (0.19.0, from bin/.cargo-deny-0.19.0.pkg), root workspace:

• On the origin/main lockfile: error[vulnerability] RUSTSEC-2026-0285, advisories FAILED. Same failure as CI.
• On this branch: advisories ok, bans ok, licenses ok, sources ok.

The desktop workspace no longer reports RUSTSEC-2026-0285 either. CI doesn't run cargo-deny on desktop/src-tauri, and that workspace still has unrelated advisories that predate this PR (h2 RUSTSEC-2026-0258, RUSTSEC-2026-0274, several unmaintained crates). They're out of scope here.