fix(security): resolve RUSTSEC-2026-0204 + rkyv advisories blocking CI

[pacphi]

Why

The Backend Security Audit gate is failing on every PR (first seen on #78, a postcss Dependabot bump that doesn't touch Rust at all) because new RustSec advisories landed:

Advisory	Crate	Fix
RUSTSEC-2026-0204	crossbeam-epoch 0.9.18	updated to 0.9.20
RUSTSEC-2026-0233/0234/0235	rkyv 0.8.16	updated to 0.8.17
RUSTSEC-2026-0235	rkyv 0.7.46	ignored in .cargo/audit.toml (see below)

The rkyv 0.7.46 ignore

There is no patched 0.7.x release (fix is only in >=0.8.17). The lone rkyv 0.7 lockfile entry comes from rust_decimal's optional legacy rkyv feature, which Ampel never enables — the crate is locked but never compiled. cargo-deny resolves the real feature graph and never even sees it, so the ignore lives only in .cargo/audit.toml (which scans the raw lockfile). Exit condition documented: remove when rust_decimal drops its optional rkyv 0.7 dependency.

Verification

• cargo audit → 0 vulnerabilities (6 pre-existing allowed warnings)
• cargo deny check advisories → ok
• cargo check --workspace --all-targets --all-features → clean

Once merged, #78 needs a @dependabot rebase to pick this up.

🤖 Generated with Claude Code

[pacphi]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

📊 Coverage Report

Component	Coverage	Status
Backend	N/A%	❓
Frontend	N/A%	❓
Overall	N/A%	❓

Coverage Thresholds

• 🟢 Green: ≥ 80% (target)
• 🟡 Yellow: 60-79% (acceptable)
• 🔴 Red: < 60% (needs improvement)

---

Coverage reports generated by CI workflow