chore(deps): document rkyv CVE exemption, restore + expand audit.toml comments

cargo audit flagged RUSTSEC-2026-0235 (rkyv, out-of-bounds read) via
rust_decimal's optional rkyv feature, which apps/payments never enables
(features = ["db-tokio-postgres"] only) - confirmed absent from the
actual feature-resolved graph via cargo tree, and cargo-deny (which is
feature-aware) already doesn't flag it. Added to both deny.toml and
.cargo/audit.toml so cargo audit also exits 0.

Also re-documented the 4 pre-existing crate-name-collision ignores in
.cargo/audit.toml (RUSTSEC-2020-0128/2021-0006/2023-0040/2023-0059 -
our own workspace crates crates/cache and apps/users happen to share
name+version with unrelated abandoned crates.io packages) with fuller
explanation, and mirrored them into deny.toml for a single source of
truth even though cargo-deny's real graph resolution never matched
them in the first place.

Verified: cargo audit and cargo deny check advisories bans both now
exit 0 against the live server runbook's requirement.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.cargo/audit.toml

@@ -1,7 +1,44 @@
+# cargo-audit configuration for nxtgauge-backend-rust
+# https://github.com/rustsec/rustsec/tree/main/cargo-audit#configuration
+#
+# Keep this in sync with the [advisories].ignore list in deny.toml — cargo-deny
+# is the gate that actually runs in CI/policy checks, but the live-server
+# runbook also runs `cargo audit` directly, so both need to agree on
+# accepted risk to both exit 0.
+
 [advisories]
 ignore = [
-    "RUSTSEC-2020-0128",
-    "RUSTSEC-2021-0006",
-    "RUSTSEC-2023-0040",
-    "RUSTSEC-2023-0059",
+  # RUSTSEC-2023-0071 - rsa: Marvin Attack timing side-channel — no upstream fix available.
+  # Impact: potential RSA key recovery via timing. Low risk: we use RSA only for JWT
+  # verification (public-key ops), not for decryption. Acknowledged (see deny.toml).
+  "RUSTSEC-2023-0071",
+  # RUSTSEC-2025-0141 - bincode: unmaintained (not a vulnerability, just no active maintainer).
+  # bincode is used transitively; no replacement available in our dep tree.
+  "RUSTSEC-2025-0141",
+  # RUSTSEC-2026-0235 - rkyv: out-of-bounds read validating Rc/Arc in archives.
+  # Pulled in only as an optional dependency of rust_decimal (apps/payments); we use
+  # rust_decimal with `features = ["db-tokio-postgres"]` only — the "rkyv" feature is
+  # never enabled, so this crate is never actually compiled into our binaries.
+  # Confirmed via `cargo tree -p payments -e features | grep rkyv` (empty). Cargo.lock
+  # still lists it because lock files record the full possible graph, not just the
+  # feature-activated one — that's also why cargo-deny (which resolves features) never
+  # flags it while cargo-audit (which scans the lockfile as-is) does. Re-check this
+  # exemption if rust_decimal's default features ever change.
+  "RUSTSEC-2026-0235",
+
+  # ── False positives: crate-name collisions with our own workspace crates ──────
+  # cargo-audit matches by (name, version) against Cargo.lock and does not check
+  # whether the entry is a local path dependency vs a crates.io registry crate.
+  # Our internal workspace crates crates/cache ("cache" 0.1.0) and apps/users
+  # ("users" 0.1.0) happen to share both name and version with unrelated,
+  # long-abandoned crates.io packages that these advisories target. cargo-deny
+  # (which resolves the real dependency graph, not just name+version matching)
+  # correctly does not flag any of these — confirmed via
+  # `cargo deny check advisories` showing none of these IDs. Verify via
+  # `grep -A3 '^name = "cache"$' Cargo.lock` (no `source = "registry+..."` line)
+  # before ever removing these.
+  "RUSTSEC-2020-0128", # "cache" — Cache<K> Send/Sync soundness (unrelated crates.io crate)
+  "RUSTSEC-2021-0006", # "cache" — exposes internal raw pointer (unrelated crates.io crate)
+  "RUSTSEC-2023-0040", # "users" — unmaintained (unrelated crates.io crate)
+  "RUSTSEC-2023-0059", # "users" — unaligned pointer read (unrelated crates.io crate)
 ]

deny.toml

@@ -22,6 +22,25 @@ ignore = [
   # RUSTSEC-2025-0141 - bincode: unmaintained (not a vulnerability, just no active maintainer).
   # bincode is used transitively; no replacement available in our dep tree.
   "RUSTSEC-2025-0141",
+  # RUSTSEC-2026-0235 - rkyv: out-of-bounds read validating Rc/Arc in archives.
+  # Pulled in only as an optional dependency of rust_decimal (apps/payments) behind
+  # its "rkyv" feature, which we never enable (we use `features = ["db-tokio-postgres"]`
+  # only) — cargo-deny's feature-aware graph already excludes it, so this entry is here
+  # purely so cargo-audit (which scans the full Cargo.lock, not the activated feature
+  # graph) can share the same ignore list via .cargo/audit.toml. See that file for detail.
+  "RUSTSEC-2026-0235",
+
+  # RUSTSEC-2020-0128, RUSTSEC-2021-0006, RUSTSEC-2023-0040, RUSTSEC-2023-0059:
+  # crate-name collisions between our own workspace crates (crates/cache "cache" 0.1.0,
+  # apps/users "users" 0.1.0) and unrelated abandoned crates.io packages of the same
+  # name+version. cargo-deny's real dependency-graph resolution already doesn't match
+  # these (they're not in the graph at all), so these entries are no-ops here — kept
+  # only so this file documents the same accepted-risk list as .cargo/audit.toml, which
+  # matches by name+version alone and does flag them. See audit.toml for detail.
+  "RUSTSEC-2020-0128",
+  "RUSTSEC-2021-0006",
+  "RUSTSEC-2023-0040",
+  "RUSTSEC-2023-0059",
 ]
 
 # ── Bans (duplicate deps / forbidden crates) ──────────────────────────────────