chore(deps): prune unused deps, tighten tokio features, align tungstenite (HY-01, HY-05, HY-07, HY-08, HY-12)

- HY-01: openapiv3 -> dev-dependencies (test-only usage)
- HY-05: drop bytes (src sites renamed to axum::body::Bytes re-export),
  keep parking_lot (genuinely used); tokio "full" -> the seven features
  actually used (macros, rt-multi-thread, io-util, net, fs, time, sync)
- HY-08: test-support extends wss; dev tokio-tungstenite matches the
  wss feature set
- HY-12: tokio-tungstenite 0.28 -> 0.29 to match axum's tungstenite;
  duplicate roots in cargo tree -d: 9 -> 6 (tungstenite, cpufeatures,
  rand dupes collapsed)
- HY-07 ride-along: READ_SLOTS privatized
- CON-10 residue: verified already fixed (full_surface required-features)

Verified: cargo test (300), --all-features (371+36), --features mcp
(355+9), --features wss (316), check --no-default-features, clippy
(all-targets and --all-features, -D warnings), fmt --check

src/adapters/forward.rs

@@ -538,7 +538,7 @@ pub(crate) fn is_json_content_type(content_type: &str) -> bool {
 /// (FWD-10): capped at [`ERROR_BODY_ECHO_CAP`] bytes, lossily decoded,
 /// control characters (which could forge log or display framing) elided,
 /// and truncated with a marker. The echo is never logged by this crate.
-fn bounded_error_body(bytes: bytes::Bytes) -> Option<String> {
+fn bounded_error_body(bytes: axum::body::Bytes) -> Option<String> {
     if bytes.is_empty() {
         return None;
     }
@@ -564,7 +564,7 @@ fn bounded_error_body(bytes: bytes::Bytes) -> Option<String> {
 async fn read_body_capped(
     response: reqwest::Response,
     cap: usize,
-) -> Result<bytes::Bytes, BodyReadError> {
+) -> Result<axum::body::Bytes, BodyReadError> {
     let mut stream = response.bytes_stream();
     let mut buf: Vec<u8> = Vec::new();
     while let Some(chunk) = stream.next().await {

src/server/adapter.rs

@@ -433,7 +433,7 @@ struct CountingBody {
 
 #[cfg(feature = "mcp")]
 impl futures::Stream for CountingBody {
-    type Item = Result<bytes::Bytes, std::io::Error>;
+    type Item = Result<axum::body::Bytes, std::io::Error>;
 
     fn poll_next(
         mut self: std::pin::Pin<&mut Self>,

src/websocket/byte_adapter.rs

@@ -65,7 +65,7 @@ pub const WS_MESSAGE_CAP: usize = 1024 * 1024;
 
 /// Inbound buffer: slots × in-flight message bytes. The WS read task
 /// awaits `send` when full — the backpressure mechanism (OQ-01a).
-pub const READ_SLOTS: usize = 64;
+const READ_SLOTS: usize = 64;
 
 const WRITE_SLOTS: usize = 64;
 
@@ -423,7 +423,7 @@ impl WsPumps {
 struct AxumFraming;
 
 impl WsFraming for AxumFraming {
-    type Bytes = bytes::Bytes;
+    type Bytes = axum::body::Bytes;
     type Msg = AxumMessage;
 
     fn binary(msg: &AxumMessage) -> Option<&Self::Bytes> {
@@ -668,7 +668,7 @@ struct TungsteniteFraming;
 
 #[cfg(any(test, feature = "wss"))]
 impl WsFraming for TungsteniteFraming {
-    type Bytes = bytes::Bytes;
+    type Bytes = axum::body::Bytes;
     type Msg = tokio_tungstenite::tungstenite::Message;
 
     fn binary(msg: &Self::Msg) -> Option<&Self::Bytes> {