chore(web): update chromiumoxide 0.5.7 -> 0.9.1

[stippi]

Summary

• Bumps chromiumoxide in crates/web from 0.5.7 to 0.9.1 (the sibling pal PR does the same for pal_music; pal consumes this crate via the [patch] section, so the two go together).
• The tokio-runtime feature no longer exists (0.9 dropped async-std; tokio is the only runtime), so the dependency line becomes plain chromiumoxide = "0.9". No source changes were needed beyond a comment.
• Transitive cleanup: async-std, tungstenite 0.20 and winreg are gone; async-tungstenite 0.32, which 8 and windows-registry come in.

What changed upstream (0.6 → 0.9)

• 0.8: tokio by default, more resilient message parsing (unknown event methods land in CdpEvent::Other instead of failing), CDP bumped to Chromium 142, option to disable automation detection.
• 0.9: async-std removed, edition 2024, CDP r1566079, Page::add_init_script, click_with, browser process no longer inherits stdout.

CDP parse noise

The "data did not match any variant of untagged enum Message" noise from recent Chromes is not gone with the newer protocol, but it is no longer ERROR level: chromiumoxide 0.9 logs it as DEBUG on chromiumoxide::conn plus one WARN per event on chromiumoxide::handler. Checked live with Chrome 152.0.7977.83: the only failing event was Network.requestWillBeSentExtraInfo (6 frames for two page loads). The comment in browser.rs now says so.

Verification

• cargo build (workspace), cargo clippy --all-targets -p web: clean
• cargo test -p web: 20 passed, including the live headless-Chrome tests (navigation, typing, cookies across launches, headless swap)