security: fix audit vulnerabilities (RUSTSEC-2026-0007, RUSTSEC-2021-0141)

- Update bytes 1.11.0 -> 1.11.1 (fixes integer overflow in BytesMut::reserve, CVE-2026-25541)
- Replace unmaintained dotenv 0.15.0 with dotenvy 0.15.7 (RUSTSEC-2021-0141)
- Note: rsa 0.9.10 (RUSTSEC-2023-0071) has no patch yet, pulled transitively via jsonwebtoken

src/bin/migrate.rs

@@ -10,10 +10,10 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
 
     // Load environment variables (.env.local first, then .env)
     if let Ok(path) = env::var("DOTENV_PATH") {
-        dotenv::from_path(Path::new(&path)).ok();
+        dotenvy::from_path(Path::new(&path)).ok();
     } else {
-        dotenv::from_filename(".env.local").ok();
-        dotenv::dotenv().ok();
+        dotenvy::from_filename(".env.local").ok();
+        dotenvy::dotenv().ok();
     }
 
     // Get DATABASE_URL from environment variables