chore(quotesdb): set up Cargo.toml with api and ui dependencies

- Add axum 0.8 + tokio 1 (native-only) for the HTTP API server
- Add rusqlite 0.32 + tokio-rusqlite 0.6 (native-only) for local SQLite
- Add async-trait 0.1 (native-only) for QuoteRepository abstraction
- Add worker 0.5 with d1 feature (wasm32-only) for Cloudflare Workers
- Add rand 0.9 + serde + serde_json (shared) for passphrase/serialisation
- Add build-dependencies: serde_json 1 + serde_yaml 0.9 for build.rs
- Pin rusqlite to 0.32 to match tokio-rusqlite 0.6 transitive dependency

Closes ticket 1f5bb5

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

quotesdb/Cargo.toml

@@ -13,13 +13,48 @@ path = "src/bin/api/main.rs"
 name = "ui"
 path = "src/bin/ui/main.rs"
 
+# Shared dependencies: compile for both native host and wasm32-unknown-unknown.
 [dependencies]
 common = { path = "../common" }
+# UUID v4 for database primary keys; serde feature for serialisation.
 uuid = { version = "1", features = ["v4", "serde"] }
+# OsRng-based passphrase generation (WASM-compatible via getrandom/wasm_js).
+rand = "0.9"
+# Serialisation for shared types (API request/response models, Quote structs).
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
 
+# Native-only dependencies (API server binary).
+# tokio, axum, and rusqlite are incompatible with wasm32-unknown-unknown.
+[target.'cfg(not(target_arch = "wasm32"))'.dependencies]
+# Async runtime for the native API server.
+tokio = { version = "1", features = ["full"] }
+# HTTP framework for the native API server.
+axum = { version = "0.8", features = ["json"] }
+# SQLite driver for local development (native only; production uses Cloudflare D1).
+# Version pinned to 0.32 to match tokio-rusqlite 0.6's transitive dependency.
+rusqlite = { version = "0.32", features = ["bundled"] }
+# Async wrapper around rusqlite for use with Tokio.
+tokio-rusqlite = "0.6"
+# Async trait support for the QuoteRepository abstraction.
+async-trait = "0.1"
+
+# WASM-only dependencies (Workers API binary + UI binary).
+# workers-rs, getrandom/wasm_js, and UI libraries are wasm32-specific.
 [target.'cfg(target_arch = "wasm32")'.dependencies]
+# Cloudflare Workers SDK — provides D1 bindings, fetch, KV, etc.
+worker = { version = "0.5", features = ["d1"] }
+# Entropy source for WASM targets: bridges uuid (v4) and rand (OsRng) to
+# crypto.getRandomValues() via the Web Crypto API.
 getrandom = { version = "0.4", features = ["wasm_js"] }
 
+# Build-time dependencies for compile-time YAML-to-JSON conversion of the
+# OpenAPI spec. serde_yaml is only needed at build time — it never enters
+# the Workers binary or native binary.
+[build-dependencies]
+serde_json = "1"
+serde_yaml = "0.9"
+
 [dev-dependencies]
 
 [profile.release]