build: modernize dependencies and backend verification

[jahvari]

Summary

• refresh the workspace's direct Rust dependency constraints and lockfile, including quick-xml 0.41.0, librqbit 9.0.1, tao 0.37.0, and cc 1.4.4
• make the server's torrent backend feature selection explicit and keep the shared EngineFS control surface available to both libtorrent and librqbit builds
• update the bundled UnRAR source to 7.23 and the used 7-Zip source subset to 26.02, with a regression-tested fix preventing included C++ translation units from being compiled twice
• refresh the Microsoft vcpkg baseline while retaining the repository's libtorrent 2.1.1 override
• enforce warning-free Clippy and test both libtorrent and librqbit configurations in pull-request CI

Scope and relationship to existing work

This supersedes #26 and #35 with one current, audited dependency update.

This PR intentionally contains no proxy or SSRF behavior changes. Issue #34 will be addressed by a separate security PR after this dependency baseline is merged, keeping review and rollback boundaries clear.

Compatibility notes

• tao 0.37 requires Rust 1.85 or newer and its current Windows dependency stack no longer targets Windows 7. The repository uses the stable Rust toolchain and does not document Windows 7 support.
• librqbit 9.0.1 includes a bounded read_chunk fix; the backend adapter changes preserve the server control API across both torrent backends.
• The vcpkg manifest still pins libtorrent 2.1.1.

Bundled source provenance

• RARLAB unrarsrc-7.2.7.tar.gz (UnRAR 7.23): SHA-256 01D903A7DCF413CB2925696D7796E48E38D471F79BFE7EF3AD2AEBF6C12DBEFD
• 7-Zip 7z2602-src.tar.xz (7-Zip 26.02): SHA-256 CF967C98BCA02A4B8B16375F441825A8E141362F14BE1969BBEC8E1CA0BFF9DD
• Microsoft vcpkg baseline: 9e593bb18ea69cc5095e012465dcd675a822ed0d

The vendored UnRAR tree matches the official source plus the repository's existing binding wrapper. The vendored 7-Zip tree is an exact subset of the official source archive.

Verification

• fork CI rehearsal: https://github.com/jahvari/stream-server/actions/runs/32526167776 (passed)
• cargo audit --file Cargo.lock: no known vulnerabilities; 18 transitive maintenance/unsoundness warnings remain in upstream dependency chains with no available direct-version upgrade
• cargo upgrade --dry-run --incompatible allow --pinned allow: no direct dependency upgrades proposed
• cargo fmt --all -- --check
• strict EngineFS librqbit Clippy with all targets
• 58 EngineFS tests on librqbit
• settings GUI tests/check and updater/runtime helper checks
• UnRAR source-selection regression test and a real MSVC build observation with zero duplicate-symbol warnings
• public-safety scan: no local paths, memory files, credentials, private keys, certificates, or proxy/security changes

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}