`cargo audit` reports 11 vulnerabilities in locked Nostr dependencies

[Nitjsefnie]

Description

On main at ce03c6ffbcbe8e4f9355c8ca83479cb8311e0fd8, the backend's locked release build succeeds, then cargo audit reports 11 vulnerabilities against the locked Nostr dependency family, including nostr 0.44.3 and nostr-relay-pool 0.44.1.

The reported vulnerability IDs are RUSTSEC-2026-0216, RUSTSEC-2026-0219, RUSTSEC-2026-0224, RUSTSEC-2026-0225, RUSTSEC-2026-0226, RUSTSEC-2026-0227, RUSTSEC-2026-0228, RUSTSEC-2026-0229, RUSTSEC-2026-0230, RUSTSEC-2026-0231, and RUSTSEC-2026-0232.

Exact-main control run: https://github.com/Nitjsefnie-OSC/bitpilot/actions/runs/32876468981

Expected Behavior

The locked backend dependency graph should pass cargo audit, or any advisory that cannot yet be removed should have an explicit, documented acceptance decision.

Reproduction Steps

1. Check out ce03c6ffbcbe8e4f9355c8ca83479cb8311e0fd8.
2. Change into backend.
3. Run cargo build --release --locked.
4. Run cargo audit and observe the 11 vulnerability findings.

Discovered During

Reviewing the base-branch CI failures surfaced by #99.

Suggested Fix

Unverified: upgrade the Nostr dependency family to the first mutually compatible release set that clears these advisories, refresh the lockfile, and run the existing backend and mission checks. If this direction fits, I can send a PR.