chore: bump 9 gem dependencies

[rz1989s]

Summary

Consolidated bump of the Dependabot gem backlog into one PR. The individual Dependabot PRs (#20, #26–28, #31–33, #38–39) all conflict on Gemfile.lock after PR #44's security patch — merging them one by one means cascading rebases. This single bundle update resolves all of them; Dependabot auto-closes its now-satisfied PRs once this merges.

Gem	Bump	Notes
puma	7.1.0 → 8.0.1	major — sole breaking change is the prod default bind (0.0.0.0 → IPv6 ::); config/puma.rb sets an explicit port, so unaffected
solid_queue	1.2.4 → 1.4.0	additive only (opt-in dynamic recurring tasks); no schema change
bootsnap	1.20.1 → 1.24.4	boot caching
selenium-webdriver	4.39.0 → 4.44.0	test only
brakeman	8.0.1 → 8.0.4	dev/CI — clears the scan_ruby "not latest version" warning
web-console	4.2.1 → 4.3.0	dev only
turbo-rails	2.0.20 → 2.0.23
thruster	0.1.17 → 0.1.21
importmap-rails	2.2.2 → 2.2.3

Gemfile.lock-only — no Gemfile change. rails left unchanged (already current). bundler-audit clean.

Test Plan

• bin/bundler-audit — no vulnerabilities
• CI test + system-test green — system-test boots puma 8, the real check
• CI scan_ruby / lint / scan_js green
• Post-merge deploy + /up health-check confirm puma 8 serves in production