chore(deps): bump russh to 0.61.2 and the crypto stack it pins (#66)

Replaces dependabot #37, which was opened against a 2026-07-28 lock file
and had drifted from master.

russh 0.61.1 -> 0.61.2 pulls a semver-compatible refresh of the crypto
crates it pins: curve25519-dalek 5.0.0-pre.6 -> rc.0, ed25519-dalek
3.0.0-pre.7 -> rc.0, elliptic-curve rc.32 -> rc.33, the p256/p384/p521
family rc.9 -> rc.10, md5 0.7 -> 0.8. RustCrypto's ff/group split lands as
the real ff 0.14 / group 0.14 crates, and the transitive windows-sys 0.60
tree drops out entirely: 157 lock lines removed against 65 added.

Cargo.toml is untouched — the constraint stays "0.61". russh 0.62.7 exists
but is a separate, API-breaking upgrade. pkg/flatpak/cargo-sources.json is
regenerated (the flatpak job diffs against it).

Upstream's fixes in this range are SEC1 EC keys with full domain parameters
and Send bounds on dynamic AgentClient refs. Neither has a Nexterm-side
test: nexterm-ssh's 15 tests never open a connection, so the crypto paths
ride on CI's three-OS build and upstream's own verification. A live SSH
session check is queued with the on-device backlog.

Author: mizu-jun

CHANGELOG.md

@@ -27,6 +27,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   shader's `stroke_width` attribute, so a focused control no longer repaints
   the area inside the ring twice. Geometry is unchanged; the boundary between
   the accent and surface bands gains a shared half-pixel of anti-aliasing.
+- `russh` 0.61.1 → 0.61.2, together with the crypto stack it pins
+  (`curve25519-dalek`, `ed25519-dalek`, the `p256`/`p384`/`p521` family).
+  Upstream fixes in this range are support for SEC1 EC keys that carry full
+  domain parameters, and `Send` bounds on dynamic `AgentClient` references.
 
 ### Fixed
 - Translucent windows (`window.background_opacity < 1.0`) no longer look