fix(ci): drop unused base64 dep + ensure Cargo.lock for e2e docker build

cargo machete flags base64 in axon-api as unused (only referenced in a
comment after the mutation-intent token signing landed); drop the dep.

Cargo.lock is .gitignored, so freshly-checked-out CI runners on cold
caches lack a lockfile when the e2e Docker build's COPY Cargo.lock step
runs. Generate one inside the e2e-postgres job when it is missing, after
Swatinem/rust-cache restore, so the docker build can hash the workspace.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: easel

.github/workflows/ci.yml

@@ -126,5 +126,10 @@ jobs:
       - uses: oven-sh/setup-bun@v2
       - name: Install protoc
         run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
+      # Cargo.lock is gitignored; the e2e Docker build COPYs it for layer
+      # caching, so generate one before docker build when the rust-cache
+      # restore did not provide it.
+      - name: Ensure Cargo.lock exists
+        run: test -f Cargo.lock || cargo generate-lockfile
       - run: cd ui && bun install
       - run: cd ui && bun run test:e2e:postgres

crates/axon-api/Cargo.toml

@@ -19,7 +19,6 @@ axon-schema = { path = "../axon-schema" }
 axon-audit = { path = "../axon-audit" }
 axon-storage = { path = "../axon-storage" }
 axon-render = { path = "../axon-render" }
-base64.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 sha2.workspace = true