Consolidate remaining dependency upgrades

[snapetech]

Consolidates the remaining conflicting/failing Dependabot upgrades into one compatible update set.

Includes:

• sidecar: tower 0.5, rusqlite 0.39, quick-xml 0.40, reqwest 0.13, thiserror 2
• webui: Vite 8, @vitejs/plugin-react 6, TypeScript 6, ESLint 10, typescript-eslint 8, eslint-plugin-react-hooks 7
• compatibility fixes for axum 0.8 websocket text payloads and quick-xml 0.40 text decoding

Local verification:

• npm ci in webui
• npm run build in webui
• cargo build --locked in sidecar
• git diff --check