Remove unused tower-http dependency (ticket 029)

Audited every entry in Cargo.toml and webapp/package.json against actual
usage. tower-http was declared but never referenced in src/ (no ServeDir,
CorsLayer, or other tower_http usage) — it was only pulled in transitively
via reqwest anyway, so it's dead weight as a direct dependency. All other
Cargo.toml and package.json entries have live usage (including include_dir,
which looked unused via grep but is required transitively by the
fs_embed::fs_embed! macro, and tailwindcss, which is pulled in via
@import "tailwindcss" in src/index.css rather than a JS import).

cargo test (143 passed) and webapp npm run build both pass after pruning.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XFUNZwCvz3kcod3352ZR2o

Cargo.lock

@@ -370,12 +370,6 @@ version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "92d699e522242e69e3003b94ecc1f960f3a5e015aa7c5d7486e65ad01dd94f5e"
 
-[[package]]
-name = "futures-sink"
-version = "0.3.34"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1944426bf7d03f1d14f708785e4b33efd750b36d48a157b836b3efc15ede8e1d"
-
 [[package]]
 name = "futures-task"
 version = "0.3.34"
@@ -460,12 +454,6 @@ dependencies = [
  "pin-project-lite",
 ]
 
-[[package]]
-name = "http-range-header"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9171a2ea8a68358193d15dd5d70c1c10a2afc3e7e4c5bc92bc9f025cebd7359c"
-
 [[package]]
 name = "httparse"
 version = "1.10.1"
@@ -786,16 +774,6 @@ version = "0.3.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
 
-[[package]]
-name = "mime_guess"
-version = "2.0.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f7c44f8e672c00fe5308fa235f821cb4198414e1c77935c1ab6948d3fd78550e"
-dependencies = [
- "mime",
- "unicase",
-]
-
 [[package]]
 name = "mio"
 version = "1.2.3"
@@ -855,7 +833,6 @@ dependencies = [
  "tempfile",
  "tokio",
  "tower",
- "tower-http",
 ]
 
 [[package]]
@@ -1516,19 +1493,6 @@ dependencies = [
  "tokio",
 ]
 
-[[package]]
-name = "tokio-util"
-version = "0.7.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "494815d09bf52b5548659851081238f0ca39ff638363907596da739561c62c52"
-dependencies = [
- "bytes",
- "futures-core",
- "futures-sink",
- "pin-project-lite",
- "tokio",
-]
-
 [[package]]
 name = "tower"
 version = "0.5.3"
@@ -1553,19 +1517,10 @@ checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
 dependencies = [
  "bitflags",
  "bytes",
- "futures-core",
  "futures-util",
  "http",
  "http-body",
- "http-body-util",
- "http-range-header",
- "httpdate",
- "mime",
- "mime_guess",
- "percent-encoding",
  "pin-project-lite",
- "tokio",
- "tokio-util",
  "tower",
  "tower-layer",
  "tower-service",
@@ -1616,12 +1571,6 @@ version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2896d95c02a80c6d6a5d6e953d479f5ddf2dfdb6a244441010e373ac0fb88971"
 
-[[package]]
-name = "unicase"
-version = "2.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dbc4bc3a9f746d862c45cb89d705aa10f187bb96c76001afab07a0d35ce60142"
-
 [[package]]
 name = "unicode-ident"
 version = "1.0.24"

Cargo.toml

@@ -6,7 +6,6 @@ edition = "2024"
 [dependencies]
 axum = { version = "0.8.9", features = ["json"] }
 tokio = { version = "1.53.1", features = ["full"] }
-tower-http = { version = "0.6", features = ["fs", "cors"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 clap = { version = "4", features = ["derive"] }

tickets/029-remove-unused-deps.md

@@ -1,29 +0,0 @@
-# 029 — Remove unused crates and dependencies
-
-## Summary
-
-Audit `Cargo.toml` and `webapp/package.json` for dependencies that are
-declared but not actually used, and remove them.
-
-## Scope
-
-- Check each `[dependencies]`/`[dev-dependencies]` entry in `Cargo.toml`
-  against actual usage (e.g. `cargo +nightly udeps`, or grepping for each
-  crate's root module name), same for `webapp/package.json` (e.g. `npx
-  depcheck`).
-- Remove anything unused. If a dependency was added ahead of a specific
-  ticket that hasn't landed yet (e.g. `fs-embed` before
-  [028](028-fs-embed-static-bundling.md) wires it in), leave it — this ticket
-  is about dead weight, not blocking in-flight work.
-- Re-run the full test suite and a production webapp build after pruning to
-  confirm nothing silently depended on a "removed" package.
-
-## Acceptance criteria
-
-- No dependency remains in either manifest without a corresponding usage in
-  the codebase.
-- `cargo test` and the webapp build both pass after pruning.
-
-## Depends on
-
-None.