[Security]: RUSTSEC-2026-0253: lru 0.12.5 in Cargo.lock is unsound (use-after-free via LruCache eviction)

### Summary

`lru` 0.12.5 — the version locked in `Cargo.lock` on `main`, pulled in
by `ratatui 0.29` — is covered by RUSTSEC-2026-0253 (later advisories
reference RUSTSEC-2026-0002): `LruCache::pop` is not panic-safe, and an
eviction that panics can leave the cache in an inconsistent state,
leading to a use-after-free or double free. The advisory is fixed in
`lru` >= 0.18.2, which `ratatui 0.29` cannot satisfy because it pins
`lru ^0.12`.

### Affected dependency chain

- `ratatui 0.29.0` (locked in `Cargo.lock`, CLI TUI startup path)
- `-> lru 0.12.5` (locked; affected range)

### Reproduction (from a clean checkout)

1. `git clone` the repository and check out `main`.
2. Run `cargo audit` (or `cargo deny check advisories`).
3. Observed: `lru` flagged as unsound at 0.12.5 (RUSTSEC-2026-0253),
with the advisory requiring `lru >= 0.18.2`.

### Suggested fix

Upgrade `ratatui` from 0.29 to 0.30 (whose `ratatui-core` requires
`lru ^0.18`, resolving the advisory), relax the `bitflags` pin from
`=2.11.1` to `^2` as required by `ratatui-core 0.1.2`, and carry the
small `Backend` trait adaptation in the CLI startup loop. I have a patch
ready and will open a PR referencing this issue.

Start with Cargo.lock and the dependency declarations that pull in ratatui 0.29, then run cargo audit or cargo deny check advisories from a clean checkout. Upgrade the dependency chain, inspect the CLI startup loop for the required Backend trait adaptation, and confirm the advisory is no longer reported and the project checks pass.

Written by the indexing model from the issue text.