[JanZachmann]

Summary

UI fixes for Vuetify 4

• OverlaySpinner: use location="center center" on v-overlay. The spinner (reboot, factory reset, update) is centered again.
• Replace the MD2 typography classes (text-h4, text-h5, text-h6, text-subtitle-1/2, text-body-1/2, text-caption) with the MD3 names from the Vuetify upgrade guide (text-headline-large, text-headline-small, text-title-large, text-body-large, text-title-small, text-body-medium, text-body-small). Two test selectors that used .text-h4 are updated.
• useAsyncAction: watch success and error messages with flush: 'sync'. The reboot and factory reset dialogs now close and stop loading after the request.

Rust dependency updates

• All compatible updates (cargo update), among them actix-web 4.15, actix-http 3.18, rustls 0.23.45, tokio 1.53, time 0.3.55.
• Major updates: crux_core / crux_http 0.20, crux_time 0.18, argon2 0.6, jsonwebtoken 11, serde_valid 3, actix-files 0.7, actix-multipart 0.8, mockall 0.15, base64 0.23.
• crux_http 0.20: HttpError::Http.body is no longer an Option; the error body is read with HttpError::body() / body_json(). A test response with a 5xx status can no longer be built as Ok(Response), so the 503 test is replaced by tests of map_http_error with crux_http::testing::rejection.
• argon2 0.6: hash_password creates the salt itself (getrandom feature). A new test checks that a hash created by argon2 0.5 still validates, so stored device passwords keep working after the update.

HTTPS listener without HTTP/2

• The UI listener is built from actix-server + actix_http::HttpService::rustls_0_23 instead of HttpServer::bind_rustls_0_23, and actix-web's rustls-0_23 feature is removed. The UI is served over HTTP/1.1 only, and h2 is no longer in the build. Workers, client disconnect timeout and graceful shutdown match the previous HttpServer setup. A TODO in main.rs names the condition to go back to bind_rustls_0_23.

Version

• Bump to 1.2.6.

Reason

On a device, starting a factory reset showed the overlay at the bottom left of the page, the text in plain body size, and the factory reset dialog stayed open with a loading button behind the overlay.

• Vuetify 4 positions overlay content by the location prop (default bottom), so the align-center justify-center classes no longer center it.
• Vuetify 4 removed the MD2 typography classes, so all headers and labels using them fell back to the default text size.
• The global message watcher in App.vue shows the toast and clears the message. It runs before the watcher in useAsyncAction, which then only saw null and never called onSuccess/onError. A sync watcher sees the message before it is cleared. The factory reset e2e test now checks that the dialog closes.

The dependency updates clear RUSTSEC-2026-0285 (rustls) and the yanked chacha20 / spin versions.

RUSTSEC-2026-0258 (h2 0.3.27, DoS via empty DATA frames) cannot be fixed by an update: it is fixed only in h2 0.4.16+, actix-http 3.x still depends on h2 0.3, and h2 does not backport fixes to 0.3 (hyperium/h2#948). actix-web's rustls-0_23 feature always enables HTTP/2, so the server offered it over ALPN and the advisory applied. Upstream tracks the h2 0.4 move in actix/actix-web#4199. HTTP/1.1 only has no real cost for a local device UI; the WebSocket already used HTTP/1.1.

Not fixed by this PR:

• RUSTSEC-2023-0071 (rsa, via jsonwebtoken): no fixed version.
• getrandom stays at 0.3: crux_http 0.20 still pulls in rand 0.9 → getrandom 0.3, which needs our wasm_js feature for the WASM build.
• bincode / proc-macro-error (unmaintained): still pulled in by crux.