Integrate stable parser, TLS and HTTP dependency patches

[ak5]

Summary

Integrate the five stable lockfile-only Dependabot updates opened after the main-only migration: #77 (TOML), #78 (Tokio Rustls), #79 (serde_json), #80 (Reqwest), and #81 (Hyper Util).

Motivation and scope

Update the parser, TLS and HTTP dependencies together so their combined behavior is checked once. Preserve all five PR head commits; use a merge commit so GitHub recognizes their ancestry as merged. The separate Python 3.15 release-candidate PR is excluded; the production image stays on stable Python 3.14.8.

Security impact

• Trust boundary changed: no.
• Credential flow changed: no.
• Threat model update not required: patch dependency versions do not alter policy or the documented credential flow.
• Exact-host, TLS, redirect, unlock and approval behavior covered by the existing quality gate and connected E2E.

Documentation

No public contract/configuration changes or literal dependency-version documentation drift. Main-only repository policy remains unchanged.

Verification

• mise run check on the combined five-update tree.
• Connected KeePass/HTTPS admin/Telegram/proxy/API E2E.
• Isolated Chrome owner passkey UI.
• Verification ran sequentially with reduced CPU priority and bounded workers.

Risk and rollback

• Risk: patch-level dependency regressions in parsing, HTTP or TLS; require fresh GitHub checks before merge.
• Rollback: revert this lockfile integration through a main PR or select a previously verified immutable image.
• Live Telegram and deployed firewall behavior were not re-tested.