ENG-6268: unify HTTP stack on http-1.x (reqwest 0.12, httptest 0.16) + dep dedup

[imp]

Summary

Stacked on #94 (axum 0.8 migration).

• reqwest 0.11 -> 0.12, httptest 0.15 -> 0.16: both were still pulling in the old hyper-0.14/http-0.2 stack alongside axum 0.8's hyper-1.x/http-1.x, duplicating the HTTP stack in the dependency tree. Both bumps were source-compatible, no code changes needed. trust-dns reqwest feature renamed to hickory-dns (upstream rename). Confirmed via cargo tree -i http@0.2 / cargo tree -i hyper@0.14 - both now empty, single unified stack.
• Considered reqwest 0.13 (latest) instead of 0.12: passed on it for now - default crypto provider changed to aws-lc (build-tooling risk), default TLS root-cert handling changed to rustls-platform-verifier (real behavior change for containerized deployments), query/form features now opt-in, and it's only ~2 months old. 0.12 already achieves the actual goal (single http-1.x stack) without those open questions.
• tower-http 0.7 -> 0.6: reqwest 0.12 hard-pins tower-http = "0.6.5" (non-optional), so bumping reqwest reintroduced a duplicate. 0.6 covers everything our own TraceLayer/classify usage in server needs, so downgrading collapses it back to one version.
• toml 0.7 -> 0.8 in server (only consumer, one trivial to_string_pretty call site), matching what config already needs.
• thiserror: transport and client now use the workspace's 2.0 instead of pinning 1 directly.

Checked the full cargo tree --duplicates list for anything else easily alignable - everything else remaining (base64, bitflags, hashbrown, rand 0.8/0.9, rustls, syn, webpki-roots, etc.) is forced by third-party deps (arrow, polars, sqlx, hickory-dns, config's pest dep) that don't share a common version we could converge on - not fixable from our side without those upstreams moving.

Test plan

• cargo check --workspace
• cargo clippy --workspace --all-targets (clean except 2 pre-existing warnings in catalog, unrelated)
• cargo fmt --all -- --check
• cargo test --workspace (all green except the same pre-existing machine-local port-3030 flake noted in ENG-6268: migrate plateau to axum 0.8 #94)