Complete third-party license docs + dependency security hardening

[rjmalves]

Summary

Completes the third-party license documentation (the previously TO-DO §4 of
THIRD_PARTY_LICENSES.md) and hardens the project's dependency-security posture.
The only runtime-behavior change is a newly-enabled Content Security Policy.

Changes (by commit)

chore(deps) — RUSTSEC fixes + updates

• Resolves two high-severity quick-xml advisories (RUSTSEC-2026-0194 / -0195,
  XML-parsing DoS) and an anyhow unsoundness (RUSTSEC-2026-0190) via
  plist → quick-xml 0.41 and anyhow → 1.0.103.
• Full cargo update to latest semver-compatible versions (Tauri 2.11.5).
• cargo audit: 0 vulnerabilities.

build(rust) — edition 2024

• Rust edition 2021 → 2024, rust-version → 1.85. std::env::set_var in
  main.rs is wrapped in unsafe {} with a SAFETY note (edition-2024 requirement;
  it runs single-threaded at startup).

feat(security) — CSP + auditing

• Replaces csp: null with a strict Content Security Policy (script-src 'self';
  styles/images limited to self + data:/blob:; no object/base/frame embedding).
  All frontend scripts and styles are local, so no remote origins are needed.
• Adds src-tauri/deny.toml (cargo-deny, scoped to the shipped Windows target as a
  blocking supply-chain gate) and .github/workflows/security-audit.yml running
  cargo-deny (blocking) + a non-blocking full-tree cargo audit on dep changes, PRs,
  and weekly.

docs — license attribution + version drift

• Fills §4 with a generated THIRD_PARTY_RUST.md (cargo-about; generator config
  committed as about.toml / about.hbs), a 408-crate license summary (all
  permissive: MIT, Unicode-3.0, Apache-2.0, MPL-2.0, BSD-3-Clause, Zlib), and a new
  §7 documenting the security posture. Corrects the inaccurate ring reference
  (no TLS/networking stack is pulled in).
• Aligns stale 0.0.1 references with the 1.0.0 release in README.md and
  package-lock.json.

Security result

• Windows (shipped) audit gate: clean — 0 vulnerabilities; the only triaged
  items are 5 unic-* unmaintained warnings (no known vulnerability, upstream-only
  via urlpattern in tauri-utils).
• 13 Linux-only advisories (gtk-rs / glib GTK3 bindings) are not compiled into
  the Windows binary and are therefore out of the gate's scope (still visible via the
  non-blocking full-tree cargo audit).

⚠️ Verify before merge

These could not be compiled in the authoring environment (no WebKitGTK libs to
build the Tauri Linux target). Please run npm run build on Windows and smoke-test:

1. Edition 2024 compiles.
2. The CSP does not break file open / view / convert / export (the export path
   relies on blob: URLs, which the policy allows).

🤖 Generated with Claude Code