chore(deps): upgrade ratatui to 0.30 (RUSTSEC-2026-0253)

[1688mengdie]

Summary

cargo audit reports the locked lru dependency as unsound:
RUSTSEC-2026-0253 (later advisories reference RUSTSEC-2026-0002).
LruCache::pop is not panic-safe; when an eviction happens while a
panic is unwinding, the cache can be left inconsistent, leading to a
use-after-free or double free. Cargo.lock on main pins lru 0.12.5
through ratatui 0.29.0, and the advisory requires lru >= 0.18.2,
which ratatui 0.29 cannot satisfy because it pins lru ^0.12.

On the CLI TUI startup path, ratatui renders the interactive
interface; a panic during eviction on that path could trigger the
unsound behavior.

This PR upgrades ratatui from 0.29 to 0.30: ratatui-core 0.1.2
requires lru ^0.18, which resolves lru to 0.18.2 and closes the
advisory. The upgrade requires two mechanical follow-ups, included in
the same commit because the intermediate states do not compile: the
bitflags pin is relaxed from =2.11.1 to ^2 as required by
ratatui-core 0.1.2, and the CLI startup loop carries an explicit
B::Error: Send + Sync + 'static bound for the new associated Error
type on the Backend trait. Only the CLI TUI startup path consumes
this API.

Fixes #2587

Type and Areas

Type: dependency

Areas: CLI TUI dependency

Verification

• cargo check --locked -p bitfun-cli --jobs 4 — passed (0 errors; 19 pre-existing warnings unchanged).
• cargo tree --locked -i lru --depth 1 — resolved lru v0.18.2 through ratatui-core v0.1.2; cargo tree --locked -i ratatui shows ratatui v0.30.2 consumed by the CLI.
• cargo test -p bitfun-cli --jobs 4 — 685 lib tests passed; 3 pre-existing failures (plugin_source_cli) are identical on the baseline commit (same names, same panic locations), so they are unrelated to this change.
• cargo fmt --check -p bitfun-cli — one pre-existing diff in peer_host/commands/dialog.rs, byte-identical on the baseline commit; no formatting change from this PR.
• Full workspace build and interactive TUI scenarios were not run locally; repository CI remains the cross-platform verification source.

Reviewer Notes

• ratatui 0.30 is the first 0.30.x release line; the lockfile resolves it to 0.30.2 and lru to exactly 0.18.2 (the advisory's minimum fixed version).
• The only source change is the explicit trait bound in src/apps/cli/src/ui/startup.rs; no behavior change is intended.
• No UI change beyond the TUI upgrade itself; no migration or persisted-shape compatibility work is applicable.
• Rollback is the inverse of the three-file change.

Checklist

• This PR is focused and does not include secrets, temporary prompts, generated scratch files, or unrelated artifacts.
• Relevant verification is recorded above, or skipped checks are explained.
• User-facing strings, docs, and locales are updated where applicable. (Not applicable: no user-facing change.)

This is an AI-assisted change.