security(deps): address RustSec warnings in GUI/TUI dependency tree #189

Context

DROID read-only audit reported RustSec warnings in the GUI/TUI dependency tree: GTK/tray related advisories through tray-icon, lru through ratatui, and other transitive warnings such as bincode, paste, number_prefix depending on the resolved graph.

Scope

• Run cargo audit --no-fetch --stale or current equivalent and capture the exact active advisories.
• Inspect Cargo.toml dependency posture for GUI/TUI dependencies.
• Prefer safe dependency updates if they are low-risk and within current public behavior.
• If a warning cannot be fixed without a larger migration, document the mitigation and create follow-up tasks.
• Do not remove GUI/TUI functionality without explicit follow-up approval.

Acceptance Criteria

• Current RustSec warnings are listed with cause, reachability, and proposed action.
• Low-risk dependency updates are applied if available.
• Remaining warnings have explicit mitigation/follow-up notes.
• cargo test --locked passes.
• cargo clippy --all-targets -- -D warnings passes.
• cargo fmt --check passes.
• If GUI dependencies are changed: cargo build --features gui --locked passes.

Audit Reference

Reported from read-only DROID audit: Cargo.toml GUI/TUI dependency tree and cargo audit warnings.