Dependency dedupe: reqwest 0.12/0.13, toml/toml_edit, thiserror 1/2, bitflags 1/2, sha2/digest splits

From the 0.9.14 refactor backlog.

`cargo tree -d` shows reqwest 0.13 (workspace pin) plus 0.12 via `oauth2 5.0` and `rmcp 3.2` — two TLS configs, two connection pools, double the build. Bump `oauth2`/`rmcp` to releases on reqwest 0.13 if they exist, or gate `rmcp`'s client feature. Also two TOML stacks (`toml` + `toml_edit`), `thiserror` 1+2, `bitflags` 1+2, `sha2`/`digest`/`crypto-common` splits. Each dedupe is compile time and binary size back.

Size: S each; batch as one PR with `cargo tree -d` before/after in the description.

Start by running `cargo tree -d` to confirm the duplicate reqwest, TOML, thiserror, bitflags, sha2, digest, and crypto-common versions. Check whether compatible oauth2 and rmcp releases use reqwest 0.13, or whether rmcp's client feature can be gated. Done means the intended duplicates are removed and before/after `cargo tree -d` results are documented.

Written by the indexing model from the issue text.