v0.6.3: russh 0.61 security bump (CVE batch) + bergshamra 0.5 + axum 0.8

Security-driven dependency release.

- russh =0.55.0 (pinned) -> 0.61.2: closes the advisory batch reachable
  from our SFTP *client* path — unbounded/allocation-first packet
  parsing (CVE-2026-48110, CVE-2026-46702, CVE-2026-46673, HIGH) plus
  CVE-2026-48107 in client auth. A malicious or compromised SFTP server
  an operator pointed us at could previously OOM the PXE server. Also
  drops mlock on non-secret buffers (~21% SSH throughput upstream) —
  directly in the remote-share ISO streaming path. ring backend kept;
  zero code changes needed in sftp_share.rs.
- bergshamra 0.4 -> 0.5.1: the pin's blocking condition (stable
  RustCrypto generation, pkcs8 0.11) is now met upstream, so the
  =0.55.0 pin is deleted and its comment rewritten as history. 0.5 is
  secure-by-default for DSig (flags we already set explicitly) and
  fixes an XML-Enc DerivedKey fallthrough.
- axum 0.7 -> 0.8.9: route captures /:id -> {id} across the router and
  the /api/docs listing; ConnectInfo optional extraction moves to the
  Result form. Gains the HEAD content-length fix (iPXE/sanboot clients
  probe with HEAD before Range requests) and puts us back on the
  maintained line.

Validation: clippy clean, fmt clean, all 272 workspace tests green.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

crates/http-api/tests/full_flow.rs

@@ -1489,9 +1489,10 @@ async fn api_docs_lists_known_endpoints() {
     }
     for needle in [
         "/api/isos",
-        "/api/isos/:id/category",
+        // v0.6.3: docs use axum 0.8's `{param}` capture syntax.
+        "/api/isos/{id}/category",
         "/api/storage/disk",
-        "/api/branding/logo/:slot",
+        "/api/branding/logo/{slot}",
         "/api/unattended",
         "/api/boot-log",
         "/metrics",