[RustedAperture]

Summary

• Fixes Dependabot alerts: zip (critical), rustls ×4, plus minimatch from npm audit.
• Server majors: sha2 0.11, hmac 0.13, rand 0.10, reqwest 0.13, validator 0.21, argon2 0.6.
• Desktop: lockfile refresh, enigo 0.1 → 0.6 (paste + cursor-location code ported).
• Web: minor/patch group, framer-motion 14, jsdom 30, @types/node 24, minimatch override.
• CI: newer GitHub Actions majors, tauri-action v1, Dependabot for actions, nix flake update.

Supersedes #10, #12, #28, #32, #37, #38, #39, #40.

Not included

• chore(deps-dev): bump typescript from 5.9.3 to 7.0.2 in /apps/web #8 TypeScript 7: typescript-eslint doesn't support TS 7 yet, so lint breaks.
• deepmerge (low): no patched version exists (via shadcn).
• glib (medium): pinned to 0.18 by Tauri's GTK3 stack.

Testing

• Server: cargo fmt --check, cargo clippy -D warnings, cargo test (197 passed).
• Desktop: cargo clippy --all-targets builds; only the same 6 old lints.
• Web: vitest (60 passed), tsc --noEmit, next build; lint unchanged (27 pre-existing errors).
• cargo audit clean in both lockfiles; npm audit 15 → 3 low.

Needs manual testing

• Desktop paste and picker positioning on Linux and Windows (enigo 0.6).
• Next tagged desktop release (tauri-action v1 renames macOS updater bundles).