Update dependencies and fix audit findings

Backend:
- cargo update: rustls 0.23.40 -> 0.23.45 (RUSTSEC-2026-0285), plus
  semver-compatible bumps (actix-web 4.15, tokio 1.53, diesel 2.3.13, ...)
- Disable actix-web's `http2` feature: the server binds plain HTTP/1.1,
  and the feature pulls in the unmaintained h2 0.3 line (RUSTSEC-2026-0258)

Frontend:
- Update all packages within their ranges, fixing 8 npm audit findings
  (nanoid, postcss, undici, ...)
- vitest 4 -> 5
- Remove unused unreadCount in RssFeeds.vue (lint error)

Cargo.toml

@@ -10,7 +10,12 @@ anyhow = "1"
 reqwest = { version = "0.13", features = ["json", "blocking"] }
 tokio = { version = "1", features = ["full"] }
 rss = { version = "2.0.13" }
-actix-web = "4.13"
+# `http2` is left out: the server binds plain HTTP/1.1 (no TLS/h2c), and the
+# feature pulls in the unmaintained h2 0.3 line (RUSTSEC-2026-0258).
+actix-web = { version = "4.15", default-features = false, features = [
+    "macros", "compress-brotli", "compress-gzip", "compress-zstd",
+    "cookies", "unicode", "compat", "ws",
+] }
 actix-rt = "2.10"
 futures = "0.3.31"
 serde = { version = "1.0.228", features = ["alloc", "derive", "serde_derive"] }