Refresh streaming-engines dependencies in one validated update

Consolidate the dependency backlog represented by Renovate PRs #72, #73, #75, #77, #78, #94–#98 and inventory additional available stable updates across workspace Rust crates, dashboard npm packages, and container/build references. Start from clean current main on one chore branch. Preserve pinned private DeepFilterNet compatibility and provisioning wire interoperability; reuse existing tests and migrate APIs where needed. No new direct dependencies without approval. No commits, publication, PR closure/merge, deployment, or live device mutation unless requested. Acceptance: inventory actual available versions (not just PR titles); apply compatible updates with necessary focused migrations; validate formatting, locked workspace all-target check/tests, optional features, Clippy, dashboard tests/build and relevant deployment tests where practical; explicitly record any deferred updates and validation/environment blockers. Keep existing Renovate PRs untouched until consolidation is ready. Inventory verified via crates.io, Cargo and Docker Hub: latest stable Rust 1.99.1; additional updates include base64 0.23, parking_lot 0.13, bindgen 0.73, prometheus-client 0.25, tower-http 0.7, utoipa 6/swagger UI 10, AWS SDK and many compatible transitive updates; dashboard Vue/Vite tooling; Alpine 3.24, VictoriaMetrics 1.155.0 and Litestream 0.5.18. Node major upgrades and Gitea action-major changes are deferred pending separate runner compatibility checks; existing supported Node 22/floating service tags retained. Private DeepFilterNet rev unchanged. Full check reproduced a Tract 0.23.9 API break in the pinned fork (TValue try_as_plain/Var/Const removed). Tract's complete family is retained at known-good 0.23.3 in Cargo.lock, with the compatibility constraint explained in gst-audio-enhance/Cargo.toml; other crates updated via selective Cargo update. Rust Docker builds now use --locked. Baseline 57 protocol tests pass with old dependencies. Captured legacy HPKE base/auth fixtures before migration and retained the old executable as a reverse-compatibility oracle. Implementation on chore/refresh-dependencies: consolidated manifest/lock updates (Cargo resolves 344 package updates), obsolete reqwest rustls-native-certs feature removed, HPKE feature/API migration reuses workspace rand 0.10; persistent-key legacy-payload regression added. Rust builders/local toolchain aligned to 1.99.1. Future Renovate updates grouped into Rust/dashboard/container PRs without enabling automerge. Dashboard tests/build pass and npm reports zero vulnerabilities; locked workspace all-target check passes after Sentry 0.49 builder/layer migration, SHA-256 hex formatting migration, Cairo text-extents fallback and Bollard STOPPING handling. New panel reducer tests pass. New HPKE payloads are successfully opened by the retained old HPKE 0.12 executable in both base and authenticated modes. Full tests/optional-feature check/Clippy still running. Alpine base and dnsmasq images build and ffmpeg/dnsmasq smoke pass. Isolated network-disabled Litestream file-replica test passes: 0.5.18 restores 0.5.16 backups, resumes replication, then restores both committed rows with full SQLite integrity checks. This does not validate Scaleway S3/networked production restore. VictoriaMetrics health/import/query smoke passes after accounting for default query-latency offset in the isolated harness. No production metric store mounted. Six updated public Dockerfiles pass BuildKit --check with no warnings (not complete Rust image builds). Full final all-feature workspace tests pass: 569 Rust tests, 8 existing opt-in tests ignored. Recording no-S3 tests and workspace all-feature check/Clippy pass; Clippy has existing/new-toolchain warnings, not warning-free certification. Desktop/mobile Chrome fixture smoke passes login, 25-room pagination, room/meeting controls and speaker queue, box settings and navigation without JS errors; preview media and mutations untested. Patch-scoped static review found no verified actionable findings but was partial around generated lockfiles, and did not audit transitive sources. Security audit: installed the official prebuilt cargo-audit 0.22.2 only under /tmp after verifying release SHA-256. Initial audit found seven advisories from AWS S3 SDK default legacy connector (Hyper 0.14, h2 0.3, Rustls 0.21/WebPKI 0.101). Disabled just the legacy rustls default feature while explicitly retaining sigv4a/http-1x/default-https-client/rt-tokio; modern HTTPS connector remains enabled. Removed obsolete stack from lock and verified dependency graph. Final audit reports zero vulnerability advisories across 700 locked packages; one unmaintained dotenv warning remains. Replacing dotenv with dotenvy is deferred because it introduces a new direct crate. Re-ran full all-feature check/tests/Clippy successfully after security fix. Both existing opt-in real-NATS provisioning integration tests pass against a fresh loopback-only JetStream container, including mixed legacy-agent recovery and encrypted retained configuration. Total final all-feature Rust suite: 569 passed/8 opt-in ignored, with those two NATS tests additionally executed and passed. Local MinIO probe using the application's actual create_s3_client passes signed bucket creation, supported-class PutObject/GetObject exact readback, object deletion and bucket deletion without legacy connector. Initial full uploader probe retried because MinIO returns InvalidStorageClass for the application's pre-existing ONEZONE_IA option; stopped that local probe and confirmed the exact rejection with a bounded raw request. Thus the production upload policy/full multipart path and real HTTPS/object-store service remain unverified, not claimed passing or modified. All fixture containers removed after use. Final scope/outcome: 321 existing Rust package-name version sets updated; 700 locked package entries; no direct dependency updates reported by final Cargo outdated, and no npm outdated entries. Tract remains intentionally at 0.23.3. All ten listed Renovate topics are covered locally, including rand 0.10 consolidation, with no existing PR merges/closures. New semantic regressions cover old HPKE payloads/persisted keys, SHA-256 cache filename compatibility, Cairo failed context behavior and Docker stopping wire/UI transitions. Validation evidence is retained under /tmp/streaming-deps-update. User authorized publication with /open-pr. Committed the validated 45-file update as d2dd2b3 (chore: Refresh dependencies and build images), pushed chore/refresh-dependencies, and opened ready PR #150 against main: https://git.kaukus.no/Kaukus/streaming-engines/pulls/150. Main was freshly fetched and unchanged at 9109e55 before publication; working tree clean with upstream tracking. PR preserves the deliberate Tract holdback, validation evidence and limitations. Existing Renovate PRs were not closed or merged. No deployment or live appliance change performed. DeepFilterNet fork migration remains separate follow-up work. Complete Rust Docker image builds, remote CI, production S3/backup restore, live NDI/hardware, preview playback and Node/Gitea major upgrades remain outside validated scope. Clippy succeeds with warnings, not -D warnings. Build outputs isolated under /tmp/streaming-deps-update because host filesystem has limited space; no existing caches deleted.