chore: update all Rust dependencies

[liukaisweetsmile-pixel]

/claim #44

Closes #44

What changed

• upgraded every remaining direct dependency to a compatible current stable generation
• migrated Tonic/Prost code generation to tonic-prost and tonic-prost-build
• replaced the obsolete Hyper 0.14 server adapter with Tonic 0.14's direct router serving API
• migrated Honeycomb OTLP setup to the OpenTelemetry 0.32 typed exporter and SdkTracerProvider builders
• upgraded Shuttle Runtime to 0.57 and the generated CI workflow to gh-workflow 0.8
• vendored protoc, removing the local/CI system-package prerequisite
• added CRUD and not-found regression tests and documented the dependency baseline

Migration matrix

Stack	Before	After
gRPC	Tonic 0.11	Tonic / tonic-prost 0.14.6
Protobuf	Prost 0.12 / tonic-build 0.11	Prost 0.14.4 / tonic-prost-build 0.14.6
Telemetry	OpenTelemetry 0.22 / OTLP 0.15	OpenTelemetry 0.32 / OTLP 0.32
Deployment	Shuttle Runtime 0.49	Shuttle Runtime 0.57
CI generation	gh-workflow 0.5	gh-workflow 0.8.1
HTTP adapter	direct Hyper 0.14 + Tower 0.4	Tonic 0.14 transport (Hyper/Tower stay transitive implementation details)
protoc	system installation / CI action	protoc-bin-vendored 3.2.0

Why this is a complete migration

Compatible-only lockfile updates leave the old Tonic, Prost, OpenTelemetry, Shuttle, and Hyper APIs in place. This change moves the mutually dependent stacks together, removes unused direct HTTP/build dependencies, and keeps the resolved tree on one Tonic 0.14 / Prost 0.14 generation.

The service behavior remains unchanged: reflection is still registered, OTLP metadata still carries the Honeycomb API key, and all CRUD RPCs keep their existing responses and not-found semantics.

Validation

• RUSTFLAGS=-Dwarnings cargo test --all-features --workspace — 3 passed, 0 failed
• cargo +nightly fmt --all -- --check — passed
• cargo +nightly clippy --all-features --workspace --all-targets -- -D warnings — passed
• git diff --check — passed

Demo

An animated verification walkthrough is attached in the first PR comment. The dependency matrix and reproducible test command are also documented in the README.

Upstream note

Cargo reports a future-incompatibility notice for proc-macro-error2 2.0.1, a transitive dependency of the latest gh-workflow 0.8.1. It does not produce a current compiler or Clippy warning, and both stable tests and nightly Clippy pass with warnings denied.

[liukaisweetsmile-pixel]

Animated verification walkthrough for the dependency migration. It shows the updated migration matrix, the exact validation commands, all three tests passing, and fmt/Clippy clean with warnings denied.

[liukaisweetsmile-pixel]

/claim #44

[liukaisweetsmile-pixel]

Hi maintainers — quick bounty claim status check: this PR contains /claim #44, the related /attempt #44 is on the issue, and the Algora account is linked to the same GitHub identity. However, the live Algora board still shows only the two older claims and has not indexed PR #76.

Could you please confirm whether this PR is eligible for the open $50 bounty and whether a maintainer or Algora needs to register the claim manually? The implementation, migration matrix, tests, and demo are complete; I’m happy to address any technical feedback.