Remove unused tower-http dependency (ticket 029)

Audited every entry in Cargo.toml and webapp/package.json against actual
usage. tower-http was declared but never referenced in src/ (no ServeDir,
CorsLayer, or other tower_http usage) — it was only pulled in transitively
via reqwest anyway, so it's dead weight as a direct dependency. All other
Cargo.toml and package.json entries have live usage (including include_dir,
which looked unused via grep but is required transitively by the
fs_embed::fs_embed! macro, and tailwindcss, which is pulled in via
@import "tailwindcss" in src/index.css rather than a JS import).

cargo test (143 passed) and webapp npm run build both pass after pruning.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XFUNZwCvz3kcod3352ZR2o

tickets/029-remove-unused-deps.md

@@ -1,29 +0,0 @@
-# 029 — Remove unused crates and dependencies
-
-## Summary
-
-Audit `Cargo.toml` and `webapp/package.json` for dependencies that are
-declared but not actually used, and remove them.
-
-## Scope
-
-- Check each `[dependencies]`/`[dev-dependencies]` entry in `Cargo.toml`
-  against actual usage (e.g. `cargo +nightly udeps`, or grepping for each
-  crate's root module name), same for `webapp/package.json` (e.g. `npx
-  depcheck`).
-- Remove anything unused. If a dependency was added ahead of a specific
-  ticket that hasn't landed yet (e.g. `fs-embed` before
-  [028](028-fs-embed-static-bundling.md) wires it in), leave it — this ticket
-  is about dead weight, not blocking in-flight work.
-- Re-run the full test suite and a production webapp build after pruning to
-  confirm nothing silently depended on a "removed" package.
-
-## Acceptance criteria
-
-- No dependency remains in either manifest without a corresponding usage in
-  the codebase.
-- `cargo test` and the webapp build both pass after pruning.
-
-## Depends on
-
-None.