chore(deps): consolidate open dependency PRs #103-#114

[pacphi]

Summary

Consolidates all 12 open Dependabot PRs into one branch, applying every
bump as latest-compatible within its existing major (manifests updated
directly, lockfiles regenerated once — not merged branch-by-branch,
which would have produced 12 conflicting lockfile diffs).

Superseded PRs

PR	Package	Bump	Area
#103	taiki-e/install-action	v2 → v2.85.4	GitHub Actions
#104	actions/download-artifact	v7 → v8	GitHub Actions
#105	tokio	1.52.3 → 1.53.1	Rust (lockfile only; manifest already "1")
#106	vitest	4.1.6 → 4.1.10	TypeScript (frontend)
#107	thiserror	2.0.18 → 2.0.19	Rust (lockfile only; manifest already "2")
#108	@testing-library/jest-dom	6.9.1 → 7.0.0	TypeScript (frontend, devDependency — unused/unwired, no risk)
#109	jsdom	29.1.1 → 30.0.1	TypeScript (frontend)
#110	sysinfo	0.39.3 → 0.39.6	Rust (lockfile only; manifest already "0.39")
#111	@tailwindcss/vite	4.3.0 → 4.3.3	TypeScript (frontend)
#112	zustand	5.0.13 → 5.0.14	TypeScript (frontend)
#113	base64	0.22.1 → 0.23.0	Rust (manifest bumped "0.22" → "0.23")
#114	jsonwebtoken	10.4.0 → 11.0.0	Rust (manifest bumped "10" → "11")

Pre-existing fixes

None — the full CI-mirrored gate (fmt, clippy -D warnings, unit +
integration tests, doctests, frontend lint/typecheck/format/test/build)
was already green on main before these bumps; no pre-existing
breakage was found or needed fixing.

Security audit

• gh api repos/pacphi/finima/dependabot/alerts: no open alerts.
• pnpm audit (frontend): no known vulnerabilities.
• cargo audit (via .github/scripts/cargo-audit.sh, honoring the
  existing audit-ignore exceptions): surfaced one new, undocumented
  finding not covered by audit-ignore:
  • RUSTSEC-2026-0221 (event-listener 5.4.1, informational —
    "unsound"): StackSlot<'_, T> unconditionally implements Send/
    Sync, allowing a !Send tag set via Event::with_tag to cross
    thread boundaries — a data race in safe code
    (advisory,
    upstream PR).
    Pulled in transitively via sqlx-core (not a direct dependency).
    Patched in 5.4.2 — a non-breaking patch release. Fixed via
    cargo update -p event-listener --precise 5.4.2; full gate
    re-verified green afterward. Nothing deferred.

Verification

All commands mirror .github/workflows/ci.yml exactly.

Backend:

cargo fmt --all -- --check                              # PASS
cargo clippy --workspace --all-targets -- -D warnings    # PASS
cargo nextest run --workspace                            # 403 passed, 4 skipped
cargo test --workspace --doc                              # PASS
bash .github/scripts/cargo-audit.sh                       # PASS (0 unaddressed findings)

Frontend:

pnpm install --frozen-lockfile   # PASS (lockfile reproduces cleanly)
pnpm run lint                    # PASS
pnpm exec tsc --noEmit           # PASS
pnpm exec prettier --check 'src/**/*.{ts,tsx,css}'  # PASS
pnpm run test -- --run           # PASS (9 passed)
pnpm run build                   # PASS
pnpm audit                       # PASS (no known vulnerabilities)

No Make/CI/doc toolchain-version references needed updating — all 12
bumps are ordinary library/action bumps, not toolchain pins (Node,
pnpm, Rust). Confirmed via grep across Makefile, .github/workflows/,
README.md, docs/**, Dockerfile*, and frontend/package.json
engines/packageManager.

[pacphi]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.