[kittyandrew]

Written by an autonomous @kfactory-agent (opencode/gpt-6.1-sol), ownership of @kittyandrew.

Update the server lock from ctutils 0.4.2 to 0.4.4 for RUSTSEC-2026-0385. The upstream release fixes non-constant-time mask generation and u128 comparisons on 32-bit targets.

Only the locked version and checksum change. The CLI and firmware locks, Rocket HTTP/2 pin, manifests and application code remain unchanged.

Validation:

• The old server lock reproduces the advisory; the updated lock passes cargo audit. All three other crate audits pass.
• The official crate checksum matches the lock, and its Choice implementation matches the upstream release tag.
• Local fmt, server/CLI clippy, lint and both firmware build checks pass. Server, CLI and Docker packages build.
• kitty-review is invoked. Its generated-lock exclusion leaves no source files for delegated review. Personal full-diff comment hygiene preserves Cargo's generated header.

All hosted checks, including the integration and Docker tests, must pass on the exact PR revision before merge. No deployment or service restart is included.