chore(deps): consolidate Dependabot updates (Cargo + CI)

[gaspb]

Description

Consolidates a batch of open Dependabot dependency updates into a single PR.

The individual Dependabot branches were stale (based on an older main that predates the vendored secrecy crate and the lazy-regex workspace dep), so merging them would have reverted main. Instead the version bumps were re-applied directly on top of the current main and verified together with cargo clippy --workspace --all-targets --locked -- -D warnings.

Resolves (safe to close once merged)

• chore(deps): bump actions/checkout from 6 to 7 #1182 — actions/checkout v6 → v7
• chore(deps): bump bytes from 1.11.1 to 1.12.1 #1186 — bytes → 1.12
• chore(deps): bump svix from 1.95.2 to 1.96.1 #1197 — svix → 1.96.1
• chore(deps): bump itertools from 0.14.0 to 0.15.0 #1185 — itertools → 0.15
• chore(deps): bump quick_cache from 0.6.23 to 0.7.0 #1196 — quick_cache → 0.7
• chore(deps): bump object_store from 0.13.2 to 0.14.0 #1183 — object_store → 0.14
• chore(deps): bump parquet from 58.3.0 to 59.0.0 #1178 — parquet → 59
• chore(deps): bump rust_iso3166 from 0.1.14 to 0.2.0 #1194 — rust_iso3166 → 0.2
• chore(deps): bump the typst group across 1 directory with 5 updates #1195 — typst group → 0.15 (typst/typst-pdf/typst-svg 0.15, typst-as-lib 0.16, derive_typst_intoval 0.8)
• chore(deps): bump ecow from 0.2.6 to 0.3.0 #1176 — ecow → 0.3 (coupled to the typst upgrade)

The typst 0.15 bump needed small code changes in meteroid-invoicing: PagedDocument moved to the typst-layout crate, PdfOptions gained creator/pretty fields, PagedDocument::pages is now an accessor method, and typst_svg::svg takes a SvgOptions argument.

Not included (need dedicated PRs)

• chore(deps): bump cached from 0.59.0 to 2.0.2 #1177 — cached 0.59 → 2.0. In 2.0 the cached Result value (including its error) must be Clone, but the codebase uses non-Clone error_stack::Report errors, and the async cache internals changed (Mutex→RwLock, TimedSizedCache→LruTtlCache), breaking the manual cache-invalidation sites. Requires a dedicated migration.
• chore(deps): bump the deps group across 1 directory with 60 updates #1203 — npm deps group. This is a React 18 → 19 major migration (plus react-day-picker v10, Radix majors, lucide-react v1, date-fns 4). It installs cleanly but produces ~47 TypeScript errors (removed global JSX namespace, changed day-picker/component APIs). Needs a dedicated frontend migration with runtime testing.
• chore(deps-dev): bump the dev-deps group across 1 directory with 18 updates #1202 — npm dev-deps group (eslint 10, babel 8, …). Entangled with the deps group; needs lint/build validation.
• chore(deps): bump the npm_and_yarn group across 2 directories with 2 updates #941, chore(deps): bump the npm_and_yarn group across 2 directories with 3 updates #1173, chore(deps-dev): bump the npm_and_yarn group across 2 directories with 3 updates #1181 — npm packages/ui groups. Obsolete: their branches are 7–13 commits behind main and would revert current versions (eslint 9→8, vite 8→6, zod 4→3, TS 6→5). main already exceeds their targets — recommend closing.

Checklist

• The code follows the project's coding conventions and style guidelines.
• cargo clippy --workspace --all-targets --locked -- -D warnings is green (lib, bins and all test targets compile). Integration suite not run here (needs a DB) — CI covers it.
• Documentation has been updated to reflect the changes (if applicable).
• All new and existing targets compile.
• I have self-reviewed my code and ensured its quality.
• I have added/updated necessary comments to aid understanding.

---

Generated by Claude Code