build(deps): bump shared-frontend to v3.0.39 + shared-core to v3.0.39

[UberMetroid]

Summary

Combines the valid scope of dependabot PRs #22 and #23 into a single dependency bump.

Changes

Crate	From	To	Where
shared-frontend	v3.0.33	v3.0.39	frontend
shared-core	v3.0.33	v3.0.39	frontend
shared-core	v3.0.33	v3.0.39	backend
shared-backend	v3.0.33	v3.0.33	backend (preserved)

shared-backend stays at v3.0.33 as instructed. It was not touched by either original PR, and keeping it pinned avoids unnecessary churn (shared-backend 3.0.34+ introduces API additions that rustle does not consume).

Source impact

None. The rustle API surface consumed by shared-* is unchanged across v3.0.33..v3.0.39:

• shared_backend::{auth::PinState, auth::attempts, auth::session, auth::read_pin_cookie, middleware::cors_layer, server::ServerConfig, server::ip::get_client_ip, tracing_init::{init_tracing, default_log_dir}}
• shared_core::i18n::Language
• shared_frontend::{Header, Footer, detect_browser_locale, set_saved_locale}

Cargo.lock

Regenerated via cargo update --workspace. Result keeps both shared-core 3.0.33 (transitively required by shared-backend 3.0.33) and the new shared-core 3.0.39.

Validation (local)

• cargo check --workspace (debug) — exit 0, no warnings
• cargo test --workspace — 25 passed, 0 failed, 9 ignored
  • backend unit tests: 7 passed (utils::tests::test_get_holiday_for_date_*)
  • backend sh bin tests: 0
  • backend integration tests: 9 ignored (#[ignore], require running container)
  • frontend unit tests: 18 passed (helpers, encryption, statuses, words, stats, holidays, share, constants)
• cargo fmt --check, cargo clippy, cargo audit, cargo deny, and the wasm32-unknown-unknown build were NOT run locally (rustfmt/clippy/audit/deny are not installed in this environment, and the project pins rust-toolchain = 1.96.0 which only CI provides). CI will validate them on push.

Files changed

• backend/Cargo.toml (+1, -1)
• frontend/Cargo.toml (+2, -2)
• Cargo.lock (+15, -6)

Tests

No new tests added. The dep bump does not introduce a real uncovered behavior in rustle (all consumed APIs already exist and were exercised before). Adding tests purely for the dep bump would be redundant dependency tests.

Notes

• This branch does NOT close or merge PRs build(deps): bump shared-frontend from v3.0.33 to v3.0.39 #22 or build(deps): bump shared-core from v3.0.33 to v3.0.39 #23, per the task scope.
• shared-backend intentionally remains at v3.0.33 per the task scope.