fix: axum-helmet use axum only for tests

[danielkov]

Summary

• bump axum-helmet from 1.0.0 to 1.0.1
• remove axum from normal dependencies and keep it only in dev-dependencies
• trim tokio dev features to the minimum needed for the current tests and doctests
• ignore .DS_Store in the repo root
• updated stale README snippets

Verification

• cargo check -p axum-helmet --lib
• cargo test -p axum-helmet

Notes

• this follows feedback in tokio-rs/axum#3684, where a maintainer suggested removing the axum dependency if the crate implementation does not require it at library compile time