chore(deps): bump tower-http from 0.6.11 to 0.7.0

[dependabot]

Bumps tower-http from 0.6.11 to 0.7.0.

Summary

Dependency bump only: tower-http = { version = "0.7", features = ["fs"] }, consumed via
ServeDir/ServeFile (the axum SPA fallback). No code changes were required for the 0.7 API —
the fs feature used here is unchanged.

Two small follow-up commits were needed to keep the repository's own gates green after the bump:

• Cargo.lock sync (8b2bf54) — the bump introduced tower-http 0.7.0 into the lock alongside the
  retained 0.6.11 (pulled in transitively by reqwest 0.13.4, which requires ^0.6.8). Cargo
  requires dependency references to be version-qualified once two versions coexist in the lock;
  the reqwest entry still read bare tower-http, so cargo metadata --locked (the CI
  "Verify Cargo.lock is in sync" step) failed after the upstream/main merge. Regenerated the lock
  with cargo metadata; the resulting one-line change qualifies the reference as
  tower-http 0.6.11.
• frontend/test/e2e/board-columns.spec.ts race fix (d396222) — the "a card dropped into
  Planning is planned and settled, never left parked" test (live-brain lane only) polls
  .not.toBe("planning") immediately after the drop, which could pass on the seed column
  (todo) before the move reached the host, and then assert a card still mid-planning-pass.
  It now waits for the transition into planning first — the same first step the mock-lane
  test takes — and then waits for the pass to settle it. This was a flaky test (the same commit
  passed on a sibling CI run), not a product regression.

Commands run locally

cargo metadata --locked
cargo fmt --all -- --check
cargo clippy --locked --all-targets -- -D warnings
cargo test --locked
cargo build --locked --bin opencompany
cd frontend && npx tsc -p tsconfig.e2e.json

Behavior changes

None to the product. The e2e test above is made deterministic; the console and board behavior it
asserts is unchanged.

[tinysweeper]

tinysweeper found nothing blocking. Approving.

             $0.0007 · 10,755 in / 2,221 out · 9,362 cached (87%) · z-ai/glm-5.2
critique:    $0.0003 · 2,849 in  / 873 out   · 2,409 cached (85%) · z-ai/glm-5.2
security:    $0.0002 · 3,312 in  / 477 out   · 2,865 cached (87%) · z-ai/glm-5.2
description: $0.0003 · 4,594 in  / 871 out   · 4,088 cached (89%) · z-ai/glm-5.2

[tinysweeper]

tinysweeper found nothing blocking. Approving.

             $0.0013 · 11,591 in / 4,943 out · 9,945 cached (86%) · z-ai/glm-5.2
critique:    $0.0008 · 3,148 in  / 3,106 out · 2,543 cached (81%) · z-ai/glm-5.2
security:    $0.0003 · 3,670 in  / 894 out   · 3,155 cached (86%) · z-ai/glm-5.2
description: $0.0003 · 4,773 in  / 943 out   · 4,247 cached (89%) · z-ai/glm-5.2