chore(deps): update dependencies and improve robustness

[da2ce7]

Summary

Update multiple Rust dependencies to their latest versions, including several
major version bumps, and implement two robustness improvements:

• Embed verify-email template as compile-time default with file override
• Isolate configuration test from environment using figment::Jail

Dependency Updates

Major Version Bumps

• derive_more: v1 → v2 (with convert_case dependency)
• jsonwebtoken: v9 → v10 (adds rust_crypto feature, replaces ring with pure-Rust crypto)
• thiserror: v1 → v2 (in main crate and located-error package)
• toml: v0 → v1 (toml 1.0 spec compliance)
• which: v6 → v8 (simplified dependencies, drops winsafe)

Significant Updates

• clap: 4.5 → 4.6 (anstream 1.0, anstyle-parse 1.0)
• tokio: 1.49 → 1.50
• chrono: 0.4.43 → 0.4.44
• uuid: 1.21 → 1.22
• aws-lc-rs: 1.15 → 1.16 (aws-lc-sys 0.37 → 0.38)
• rustls: 0.23.36 → 0.23.37
• serde_with: 3.16 → 3.18
• tracing-subscriber: 0.3.22 → 0.3.23
• wasm-bindgen family: 0.2.108 → 0.2.114
• tempfile: 3.25 → 3.27
• many other transitive dependency updates

Functional Improvements

Verify-Email Template Embedding

• Added VERIFY_EMAIL_DEFAULT constant with include_str! for compile-time embedding
• Template loading now attempts templates/verify.html from working directory first
• Falls back to embedded default if file is absent
• Uses add_raw_template instead of add_template_file for consistency

Configuration Test Isolation

• Replaced drop(initialize_configuration()) with figment::Jail::expect_with
• Test now loads default config from share/default/config/index.development.sqlite3.toml
• Sets TORRUST_INDEX_CONFIG_TOML environment variable within jail
• Eliminates dependency on external environment variables during test execution
• Added #[allow(clippy::result_large_err)] to suppress false positive lint

Motivation

• Security: Keep dependencies current with security patches
• Maintenance: Reduce technical debt by updating major versions
• Robustness: Ensure email verification works even when template file is missing
• Test Reliability: Make configuration test deterministic and environment-independent
• Modernization: Leverage latest features and performance improvements

Testing Performed

• cargo check --workspace --all-targets --all-features passes
• cargo test --workspace passes (including updated config test)
• Verified email template fallback behavior with missing file
• Confirmed jsonwebtoken v10 with rust_crypto feature works correctly

Breaking Changes

None. All updates maintain backward compatibility:

• jsonwebtoken v10 maintains same API with pure-Rust crypto backend
• derive_more v2 preserves existing derive macros
• thiserror v2 is source-compatible with v1
• toml v1 maintains spec 1.0 compatibility
• Template fallback ensures existing deployments continue working

Migration Needed

• No action required for existing users
• Deployers can optionally place templates/verify.html to customize email template
• Developers should run cargo update to sync local lockfile

References

• jsonwebtoken v10 changelog: https://github.com/Keats/jsonwebtoken/blob/master/CHANGELOG.md
• thiserror v2 migration guide: https://github.com/dtolnay/thiserror/releases
• toml v1.0 specification: https://toml.io/en/v1.0.0
• figment Jail documentation: https://docs.rs/figment/latest/figment/struct.Jail.html

[Copilot]

Pull request overview

This PR updates a broad set of Rust dependencies (including several major-version bumps) and adds two robustness improvements: embedding the verify-email template in the binary with an optional on-disk override, and making the configuration bootstrap test deterministic by isolating environment variables with figment::Jail.

Changes:

• Bump multiple dependencies across the workspace, including derive_more v2, jsonwebtoken v10 (+rust_crypto), thiserror v2, toml v1, and which v8.
• Embed templates/verify.html into the binary and load an on-disk templates/verify.html only if present.
• Update the default-config bootstrap test to use figment::Jail and inject the default TOML via TORRUST_INDEX_CONFIG_TOML.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/tests/bootstrap/config.rs	Makes the config bootstrap test environment-independent via figment::Jail and embedded default TOML.
src/mailer.rs	Adds a compiled-in default verify-email template and runtime override loading from the working directory.
packages/located-error/Cargo.toml	Updates thiserror dev-dependency to v2 to match the workspace upgrade.
Cargo.toml	Updates primary dependency versions/features (notably jsonwebtoken v10 with rust_crypto).
Cargo.lock	Refreshes the lockfile for all direct/transitive dependency upgrades.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[codecov]

Codecov Report

❌ Patch coverage is 42.85714% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 52.18%. Comparing base (f626613) to head (103d55f).
⚠️ Report is 8 commits behind head on develop.

Files with missing lines	Patch %	Lines
src/mailer.rs	42.85%	4 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff             @@
##           develop     #835      +/-   ##
===========================================
+ Coverage    52.13%   52.18%   +0.04%     
===========================================
  Files          117      117              
  Lines         6199     6205       +6     
  Branches      6199     6205       +6     
===========================================
+ Hits          3232     3238       +6     
- Misses        2886     2887       +1     
+ Partials        81       80       -1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[da2ce7]

ACK 103d55f