chore: update all dependencies, pin them exactly and require Rust 1.90

[MotherSphere]

Brings every dependency to its latest release, pins the manifests to exact versions, and makes CI lint and test the Rust code on all three platforms.

Dependencies

• cargo update: the same lockfile refresh as Dependabot chore(deps): bump the cargo-minor group across 1 directory with 159 updates #36 (tauri 2.12.3, wry 0.57, reqwest 0.13.5, serde 1.0.229, ...), one step newer where a release landed since, refreshed again on 2026-10-14 (rustls 0.23.46, tokio 1.53.3, schemars 1.2.3, deranged, equivalent, rustls-native-certs). The five crates cargo update still reports behind latest (toml 0.8.2, toml_datetime, toml_edit, brotli-decompressor, generic-array) are held by version requirements in system-deps, brotli and crypto-common, not by this manifest.
• npm lockfile refreshed within ranges (postcss 8.5.30). npm outdated --all now lists only TypeScript 7, which is held back as explained below.
• rust-version moves from 1.88 to 1.90. The MSRV job on chore(deps): bump the cargo-minor group across 1 directory with 159 updates #36 failed with tauri@2.12.2 requires rustc 1.90 (also muda 0.20, tauri-build, tauri-runtime, tauri-utils; uuid 1.28 needs 1.89). The comment above it and the README now say 1.90.
• npm: @tauri-apps/api 2.12.3 (matches the tauri crate), @tauri-apps/cli 2.12.2, and TypeScript 5.9.3 to 6.0.3, the newest major svelte-check accepts. svelte-check passes with 0 errors and 0 warnings on 6.0.3.
• TypeScript 7 stays out: svelte-check's peer range stops at 6, so npm ci fails on 7 (the ERESOLVE in chore(deps-dev): bump typescript from 5.9.3 to 7.0.2 #18), and svelte-check 4.7 only runs 7 through an experimental --tsgo mode that needs TypeScript 6 installed alongside. .github/dependabot.yml now ignores semver-major TypeScript updates, with a comment saying when to remove the ignore.

Exact pins and crate metadata

• src-tauri/Cargo.toml: every dependency, dev-dependency and build-dependency is pinned to the full version in Cargo.lock (tauri 2.12.3, tauri-build 2.7.2, steamworks-sys 0.13.0, libc 0.2.190, winreg 0.56.0, windows-sys 0.61.2, ...), features unchanged.
• package.json: exact versions, no ^, matching package-lock.json.
• description no longer says Linux only, authors is Project Colony, repository points at this repo.
• license is GPL-3.0-only in both manifests, replacing the deprecated GPL-3.0 SPDX alias. The README already gave GPL-3.0-only as the identifier; the or-later question is unchanged.
• [profile.release]: lto = "thin" and strip = "symbols", as in the Colony release profile. codegen-units = 1, opt-level = 3 and panic = "unwind" (with its comment) stay.

CI

• Node lts/* instead of Node 20, which is end of life.
• actions/setup-node moves from v7.0.0 to v7.1.0 in ci.yml and release.yml. Every other action is already on its latest release.
• dtolnay/rust-toolchain moves from 89b12181 (stable branch, before the action's input-handling fix) to e2a55d2f on master with toolchain: stable, the pin release.yml already uses. The MSRV job keeps its own toolchain input.
• Every leg runs cargo clippy --all-targets -- -D warnings, which replaces cargo check, and cargo test. Windows now runs the unit tests too. cargo test and the "Start without libsteam_api installed" build from fix: let the Linux and macOS binaries start without Valve's Steamworks library installed #37 now pass --target like Clippy, so all three share target/<triple>/debug.
• Clippy fixes: sort_by_key with Reverse in the fuzzy search, a negation instead of == false in start_client, and build.rs now generates the 1052 Steamworks function names as a static rather than a const (clippy::large_const_arrays).

Merged with #35

#35 landed first, so main is merged into this branch. The three conflicts are resolved as planned: dirs is pinned to 7.0.0 (current, and it only changes preference_dir on Windows, which SAM does not call), ci.yml keeps #35's Frontend checks step before Clippy, and the README keeps #35's checks section with Rust 1.90. cargo update after the merge found nothing newer.

Verification

• cargo clippy --locked --all-targets -- -D warnings on Linux: clean.
• cargo test --locked on Linux: 4 passed, including the test that calls through the Steamworks stubs.
• cargo update --dry-run: nothing left to update within the pins.
• After the 2026-10-14 refresh: cargo clippy --locked --all-targets -- -D warnings clean, cargo test --locked 4 passed, npm run build with svelte-check at 0 errors and 0 warnings.
• npm ci, npm run build (svelte-check, then vite build): 0 errors, 0 warnings.
• After merging main: cargo clippy --locked --all-targets -- -D warnings clean, npm run build, check:i18n, check:style, npm test and check:vendored pass.
• Windows, macOS and the 1.90 MSRV build are left to this PR's CI.

Supersedes #36. #18 is closed with a pointer here.