Update dependencies and add dependency audit gates.

README.md

@@ -59,6 +59,25 @@ Local macOS packages are ad-hoc signed without hardened runtime. A Developer ID
 
 Contributor workflow and project invariants are documented in [AGENTS.md](AGENTS.md).
 
+## Development gates
+
+Install the dependency audit tools once:
+
+```sh
+cargo install cargo-machete cargo-outdated
+```
+
+Before committing, verify dependency usage and freshness, then build and test the complete workspace:
+
+```sh
+cargo machete --with-metadata
+cargo outdated --workspace --root-deps-only --exit-code 1
+cargo build --workspace
+cargo test --workspace
+```
+
+The full test suite starts loopback-only mock and preview servers, so localhost binding must be permitted.
+
 ## Headless server
 
 Run `bds-cli server` for a dedicated headless process, or set `BDS_MODE=server` when launching `bds-ui`. The SSH listener defaults to `127.0.0.1:2222`; use `--bind`/`BDS_SSH_BIND` and `--port`/`BDS_SSH_PORT` to opt into another address. Startup prints the private `authorized_keys` path. The desktop creates its own private `id_ed25519.pub`; add that public key to the server file, then use **File → Connect to Server…** and select a remote project. Host keys are recorded on first connection and verified thereafter. Run `bds-cli tui` or set `BDS_MODE=tui` for the local terminal workspace; an authenticated SSH shell opens the same workspace against server-side data and locale. Press `:` for its command list and `:?` for help.

crates/bds-core/Cargo.toml

@@ -47,3 +47,6 @@ ort = { workspace = true }
 
 [dev-dependencies]
 tempfile = "3"
+
+[package.metadata.cargo-machete]
+ignored = ["libsqlite3-sys"]

crates/bds-server/Cargo.toml

@@ -12,7 +12,6 @@ bds-core = { workspace = true }
 bds-editor = { workspace = true }
 anyhow = { workspace = true }
 chrono = { workspace = true }
-clap = { workspace = true }
 dirs = { workspace = true }
 image = { workspace = true }
 russh = { workspace = true }

crates/bds-ui/Cargo.toml

@@ -20,7 +20,7 @@ anyhow = { workspace = true }
 tokio = { workspace = true }
 uuid = { workspace = true }
 futures = { workspace = true }
-wry = "0.55"
+wry = "0.55.1"
 
 [target.'cfg(target_os = "macos")'.dependencies]
 objc2 = "0.6"
@@ -29,7 +29,7 @@ objc2-app-kit = "0.3"
 
 [dev-dependencies]
 fluent-syntax = { workspace = true }
-syn = { version = "2", features = ["full", "visit"] }
+syn = { version = "3", features = ["full", "visit"] }
 tempfile = "3"
 
 [build-dependencies]
@@ -61,3 +61,6 @@ minimum-system-version = "26.0"
 
 [package.metadata.packager.nsis]
 installer-icon = "assets/app-icons/bds.ico"
+
+[package.metadata.cargo-machete]
+ignored = ["winresource"]