chore(deps): update all dependencies (#22)

* chore(deps): bump frontend dependencies and drop unused

- Bump direct deps to latest including majors:
  typescript ~5.9 -> ~6.0, eslint ^9 -> ^10, @eslint/js ^9 -> ^10,
  @types/node ^24 -> ^25, lucide-react ^1.7 -> ^1.12, shadcn ^4.1 -> ^4.6,
  vite ^8.0.1 -> ^8.0.10, vitest ^4.1.2 -> ^4.1.5, @base-ui/react ^1.3 -> ^1.4,
  recharts ^3.8.0 -> ^3.8.1, tailwindcss ^4.2.2 -> ^4.2.4, plus minor bumps.
- Remove unused deps surfaced by depcheck:
  react-use-websocket (replaced earlier by native WebSocket),
  @fontsource-variable/geist (no references in src/ or styles),
  @testing-library/jest-dom (vitest setupFiles is empty; matchers never wired).
- Drop deprecated tsconfig baseUrl (TS 6 removes it in 7.0); paths still
  resolve relative to tsconfig.json so the `@/*` alias keeps working.
- npm audit is clean after the bump (was 2 moderate; transitive shadcn/hono).

No metrics contract change. Build, type-check and 78 vitest specs pass.

* chore(deps): bump rust dependencies

- reqwest 0.12 -> 0.13 (only direct dep with a major bump available);
  no source changes needed (Client builder API unchanged for our usage).
- cargo update refreshes the lockfile within existing semver ranges:
  axum 0.8.8 -> 0.8.9, clap 4.6.0 -> 4.6.1, sysinfo 0.38.x patch,
  tokio 1.50 -> 1.52, tower-http 0.6.x patch, plus rustls/wasm/icu chain.

cargo fmt / cargo clippy --all-targets -D warnings clean. 72 tests pass.
cargo machete reports no unused crates.

* docs: condense CLAUDE.md project rules

Trim verbose framing while preserving every operative rule: branch/PR
protection, conventional-commit/release-please mapping, pre-commit
checks, the metrics contract touchpoint list, and the tests-with-change
expectation.

Author: niklasfrick

CLAUDE.md

@@ -1,62 +1,59 @@
 # spark-dashboard — Claude project rules
 
-These rules are project-specific. Global coding/test/security rules in `~/.claude/rules/` still apply.
+Project-specific. Global rules in `~/.claude/rules/` still apply.
 
-## Pre-commit verification (NON-NEGOTIABLE)
+## Branches & PRs
 
-CI fails fast on formatting. Always run the same checks CI runs *before* committing — do not skip, do not batch for "later".
+- `main` is protected. No direct pushes. Every change goes through a PR.
+- Branch name: `<type>/<slug>` (`feat/...`, `fix/...`, `docs/...`).
+- Squash-merge PR title = the commit on `main` → it must be a valid Conventional Commit.
+- All `ci.yml` jobs (rust, frontend, installer) must pass before merge.
 
-### Rust changes (anything under `src/`, `Cargo.toml`, `Cargo.lock`)
+## Commits drive releases
 
-Run from the repo root, in this exact order (mirrors `.github/workflows/ci.yml` → job `rust`):
+`release-please` reads commits on `main` to bump versions and publish to crates.io. Format: `<type>(<scope>)<!>: <description>`.
+
+| Type                                                       | Bump (pre-1.0)                  |
+| ---------------------------------------------------------- | ------------------------------- |
+| `feat:`                                                    | minor                           |
+| `fix:`                                                     | patch                           |
+| `feat!:` / `BREAKING CHANGE:`                              | minor (becomes major after 1.0) |
+| `chore`, `docs`, `refactor`, `test`, `ci`, `perf`, `style` | none                            |
+
+Tags: `vX.Y.Z`. After merge, release-please opens a rolling release PR; merging it tags + triggers `publish.yml` (`cargo publish`).
+
+**Never hand-edit**: `Cargo.toml` version, `Cargo.lock`, `.release-please-manifest.json`, `frontend/package.json`, `frontend/package-lock.json`, `CHANGELOG.md`. Release-please owns them.
+
+## Pre-commit checks (run before pushing)
+
+Rust changes (`src/`, `Cargo.*`):
 
 ```bash
 cargo fmt --all -- --check
 cargo clippy --all-targets --locked -- -D warnings
 cargo test --locked
 ```
 
-All three must exit 0. If `fmt --check` fails, run `cargo fmt --all` to fix, then re-run the check.
-
-Note: the CI rust job builds the frontend first because `rust-embed` needs `frontend/dist/` at compile time. If you touched embedded assets, also run `(cd frontend && npm ci && npm run build)` before `cargo clippy`/`cargo test`.
-
-### Frontend changes (anything under `frontend/`)
+Frontend changes (`frontend/`):
 
 ```bash
-cd frontend
-npm run build
-npm test -- --run
+cd frontend && npm run build && npm test -- --run
 ```
 
-Both must pass.
-
-### When in doubt
-
-If a change touches *both* Rust and frontend (e.g. metrics shape changes), run the full Rust block AND the full frontend block. CI runs both; you should too.
-
-## Cross-stack contract: metrics
-
-The metrics payload is consumed by the frontend. When you change *any* of the following, you must update *all* of the listed touchpoints in the same commit (or the same PR at minimum):
+If both stacks changed, run both blocks. If embedded assets changed, build the frontend first (`rust-embed` needs `frontend/dist/`).
 
-**Trigger** — changes to:
-- `MemoryMetrics` / `GpuMetrics` / `CpuMetrics` struct shapes in `src/metrics/`
-- JSON field names / `serde` rename attributes
-- Display logic (e.g. `display_total_bytes`, formatters, marketed-capacity rounding)
-- New metric fields (added or removed)
+## Metrics contract (Rust ↔ frontend)
 
-**Required updates**:
-1. **Rust unit tests** in `src/metrics/` — cover the new field/branch (`#[cfg(test)]` modules)
-2. **TypeScript types** in `frontend/src/types/metrics.ts` — keep in sync with serde output
-3. **Frontend formatters** in `frontend/src/lib/format.ts` — if the value needs human formatting
-4. **Vitest specs** in `frontend/src/__tests__/` — cover new rendering / formatting behavior
-5. **Affected components** in `frontend/src/components/` — wire new fields through
+When you change `MemoryMetrics`/`GpuMetrics`/`CpuMetrics` shape, serde names, display logic, or fields — update all of these in the same PR:
 
-If any of (1)–(5) is genuinely not applicable, say so explicitly in the commit message. Default assumption is that all five are needed.
+1. Rust unit tests in `src/metrics/`
+2. TS types in `frontend/src/types/metrics.ts`
+3. Formatters in `frontend/src/lib/format.ts`
+4. Vitest specs in `frontend/src/__tests__/`
+5. Components in `frontend/src/components/`
 
-## When adding or changing any feature
+If one is genuinely N/A, say so in the commit.
 
-Add or update tests in the same commit. No behavior change ships without test coverage updates — backend OR frontend. This has been forgotten before; do not repeat.
+## Tests ship with the change
 
-- New Rust function with branching logic → unit test in same file's `#[cfg(test)] mod tests`
-- New frontend component or formatter → Vitest spec in `frontend/src/__tests__/`
-- New API field → both the Rust serializer test AND the frontend type/test
+No behavior change merges without test coverage in the same PR. Rust branches → `#[cfg(test)]`. Frontend components/formatters → Vitest. New API field → both sides.