chore(deps): migrate to Bevy 0.16, axum 0.8, and other package updates

- Bump bevy 0.15 → 0.16; fixes all breaking API changes:
  ChildBuilder → ChildSpawnerCommands, Parent → ChildOf,
  despawn_descendants → despawn_related::<Children>(),
  despawn_recursive → despawn (now recursive by default),
  EventWriter::send → write, Query::{get_single,get_single_mut}
  → {single,single_mut}, ChildOf::get → parent()
- Bump axum 0.7 → 0.8; remove axum::async_trait from FromRequestParts
- Bump tower_governor 0.4 → 0.8; fix GovernorLayer::new() API
- Bump jsonwebtoken 9 → 10 with rust_crypto feature only
- Bump thiserror 1 → 2, dirs 5 → 6, bcrypt 0.15 → 0.19,
  reqwest 0.12 → 0.13 (rustls feature rename)
- Regenerate .sqlx offline cache for sqlx compile-time query checks

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

solitaire_server/src/lib.rs

@@ -64,9 +64,7 @@ fn build_router_inner(pool: SqlitePool, rate_limit: bool) -> Router {
                 .finish()
                 .expect("invalid governor config"),
         );
-        auth_routes.layer(GovernorLayer {
-            config: governor_conf,
-        })
+        auth_routes.layer(GovernorLayer::new(governor_conf))
     } else {
         auth_routes
     };