[squarepots]

Part of #110.

What changed

The in-range updates from the Renovate dashboard and its lock file maintenance, recreated as a maintainer commit:

• packageManager: pnpm 10.34.7 → 10.34.8.
• src-tauri/Cargo.lock: cargo update within the existing requirements, for example tokio 1.54.1, hyper 1.12.0, rustls-platform-verifier 0.7.1, webpki-root-certs 1.0.11, rfd 0.16.1 and the ICU 2.4 crates. The lock drops from 544 to 536 packages as older duplicates fall out (the objc2 0.5 family, core-graphics 0.24 and windows-sys 0.59).
• pnpm-lock.yaml: @asamuzakjp/css-color 7.1.7 → 7.1.9 (a jsdom dependency). Regenerated on top of Move the frontend toolchain to Vite 8, Vitest 5 and TypeScript 7 #235.

Cargo.toml and package.json requirements are unchanged.

Why

This keeps the lock files current without changing any requirement range or application code.

Held back, because they were published less than three days ago (the npm minimumReleaseAge in .github/renovate.jsonc, applied to both lock files here):

• The Tauri plugin releases from today: dialog 2.8.4, updater 2.14.1 (zip 9 in its Windows extraction path) and single-instance 2.5.5 (moves the lock release to cleanup_before_exit), on both the Rust and npm sides.
• lucide-react 1.62/1.63.
• brotli 9.1.1, rustix 1.1.6, openssl-probe 0.2.2 and xattr 1.7.0.

The dashboard offers them again once they are old enough.

Validation

• Locally on Windows: pnpm run ci:source frontend (184 Vitest tests passed, then type check and build) and pnpm run ci:source platform (Tauri debug build, cargo clippy --all-targets --locked -D warnings, cargo test --locked: 189 passed, 2 ignored), rerun after merging Move the frontend toolchain to Vite 8, Vitest 5 and TypeScript 7 #235 and Move aes-gcm to 0.11 and sysinfo to 0.39 #237.
• Every changed crate and npm package version is at least three days old.
• This PR's CI runs every source job on Linux, macOS and Windows against the new lock files.