fix(ci): patch rustls for RUSTSEC-2026-0285 and unbreak the Android SDK setup

[hamidfzm]

Summary

Two unrelated CI breakages currently fail every PR. This fixes both.

Cargo Audit. RUSTSEC-2026-0285 was published: rustls 0.23.40 incorrectly accepts TLS 1.3 handshake messages across encryption level boundaries (fixed in >= 0.23.45). This bumps the transitive rustls pin in src-tauri/Cargo.lock to 0.23.45, the newest 0.23.x release. rustls reaches Glyph through reqwest 0.12 (via sentry and tauri-plugin-http), hyper-rustls, and tokio-rustls. All of them accept ^0.23, so no dependent caps it below the fix and no Cargo.toml change is needed.

Build / Android. android-actions/setup-android installs tools platform-tools by default. The ubuntu runner image now ships cmdline-tools 16.0, which no longer carries the legacy tools package, so the step dies with Warning: Failed to find package 'tools' and sdkmanager ... failed with exit code 1. The same failure hits #764 and #765. The latest release of the action (v4.0.1) still has that default, so bumping it would not help; the step now requests platform-tools only. The NDK is still installed by the following step, and Gradle fetches the platform and build tools it needs.

Changes

• src-tauri/Cargo.lock: rustls 0.23.40 -> 0.23.45 (cargo update -p rustls --precise 0.23.45), with rustls-webpki 0.103.13 -> 0.103.15 pulled along
• .github/workflows/ci-build.yml: pass packages: platform-tools to setup-android so it stops requesting the removed tools package

Risk classification

• Persistence / data loss
• Asynchronous ordering / races
• Destructive lifecycle (close, unmount, workspace switch, app exit)
• Filesystem / IPC surface
• Untrusted rendering (Markdown, plugins, links)
• Secrets / credentials
• Network
• Migrations / persisted-format changes
• Accessibility
• Bundle size / startup
• No risk areas touched

Invariants at stake and evidence

Network: patch-level bump of the TLS stack used by outbound HTTPS (Sentry reporting and tauri-plugin-http). No API or config change; the patch releases only tighten handshake validation. Evidence:

• cargo audit in src-tauri/ before: error: 1 vulnerability found! (RUSTSEC-2026-0285, rustls 0.23.40). After: exit 0, no vulnerabilities, only the existing allowed warnings (unmaintained fxhash, proc-macro-error, unic-*, and glib unsoundness).
• Gates green: pnpm typecheck && pnpm check && pnpm test, cargo test --lib, and cargo clippy --all-targets -- -D warnings.
• The workflow change is CI-only; the Build / Android check on this PR is its evidence.

Testing

• Tested on macOS
• Tested on Windows
• Tested on Linux

Local gates and cargo audit on Windows; CI covers the other platforms and the Android build.

Screenshots

N/A

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.69%. Comparing base (9580d9f) to head (00e0886).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #766   +/-   ##
=======================================
  Coverage   99.69%   99.69%           
=======================================
  Files         548      548           
  Lines       22584    22584           
  Branches     2467     2467           
=======================================
  Hits        22516    22516           
  Misses         17       17           
  Partials       51       51           

Flag	Coverage Δ
frontend	99.41% <ø> (ø)
rust	99.92% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

[codecov]

Bundle Report

Bundle size has no change ✅