chore(deps): prune unused deps, tighten tokio features, align tungstenite (HY-01, HY-05, HY-07, HY-08, HY-12)

- HY-01: openapiv3 -> dev-dependencies (test-only usage)
- HY-05: drop bytes (src sites renamed to axum::body::Bytes re-export),
  keep parking_lot (genuinely used); tokio "full" -> the seven features
  actually used (macros, rt-multi-thread, io-util, net, fs, time, sync)
- HY-08: test-support extends wss; dev tokio-tungstenite matches the
  wss feature set
- HY-12: tokio-tungstenite 0.28 -> 0.29 to match axum's tungstenite;
  duplicate roots in cargo tree -d: 9 -> 6 (tungstenite, cpufeatures,
  rand dupes collapsed)
- HY-07 ride-along: READ_SLOTS privatized
- CON-10 residue: verified already fixed (full_surface required-features)

Verified: cargo test (300), --all-features (371+36), --features mcp
(355+9), --features wss (316), check --no-default-features, clippy
(all-targets and --all-features, -D warnings), fmt --check

src/adapters/forward.rs

@@ -538,7 +538,7 @@ pub(crate) fn is_json_content_type(content_type: &str) -> bool {
 /// (FWD-10): capped at [`ERROR_BODY_ECHO_CAP`] bytes, lossily decoded,
 /// control characters (which could forge log or display framing) elided,
 /// and truncated with a marker. The echo is never logged by this crate.
-fn bounded_error_body(bytes: bytes::Bytes) -> Option<String> {
+fn bounded_error_body(bytes: axum::body::Bytes) -> Option<String> {
     if bytes.is_empty() {
         return None;
     }
@@ -564,7 +564,7 @@ fn bounded_error_body(bytes: bytes::Bytes) -> Option<String> {
 async fn read_body_capped(
     response: reqwest::Response,
     cap: usize,
-) -> Result<bytes::Bytes, BodyReadError> {
+) -> Result<axum::body::Bytes, BodyReadError> {
     let mut stream = response.bytes_stream();
     let mut buf: Vec<u8> = Vec::new();
     while let Some(chunk) = stream.next().await {