chore(deps): bump lz4_flex and rustls-webpki (partial #26)

[saagpatel]

What

Two patch-level bumps in src-tauri/Cargo.lock:

• lz4_flex 0.11.5 → 0.11.6
• rustls-webpki 0.103.9 → 0.103.13

Why

Partial replacement for #26 — the Dependabot cargo-group PR bundled three updates:

• rand 0.8.5 → 0.9.2 — major API break, carved off to its own follow-up PR (requires thread_rng() → rng() rename in src-tauri/src/security.rs)
• lz4_flex patch ← this PR
• rustls-webpki patch ← this PR

Splitting lets the two low-risk patches land immediately while the rand migration gets isolated review.

Wave 4 (remainder, pre-Wave 5) of the audit remediation plan.

How

cd src-tauri && cargo update -p lz4_flex@0.11.5 -p rustls-webpki. Targeted update; no other crate moves. 10-line Cargo.lock diff, no code changes.

Testing

• Commands run: cd src-tauri && cargo check
• Results: clean build (38s, no warnings from the bump)

Performance impact

• Bundle delta: N/A (Rust lockfile change)
• Build time delta: negligible
• Lighthouse delta: none
• API latency delta: none
• DB query delta: none

Risk / Notes

• Both are patch bumps on stable libraries; minimal API surface change
• rustls-webpki 0.103.13 carries a certificate validation fix over 0.103.9; good to pick up
• Do NOT close build(deps): bump the cargo group across 1 directory with 3 updates #26 yet — the rand half is still outstanding and will be handled in a follow-up PR

Screenshots (UI only)

• N/A

Lockfile rationale (if lockfile changed)

• src-tauri/Cargo.lock touched: only lz4_flex and rustls-webpki version lines changed, everything else identical.

🤖 Generated with Claude Code