Update crates - #79

Moves the whole graph to latest: bitfield 0.14->0.19, cpal 0.15->0.18,
env_logger 0.10->0.11, png 0.17->0.18, rfd 0.15->0.17, socket2 0.5->0.6,
spin 0.10->0.12, libchdman-rs 0.288->0.289, windows-sys 0.52->0.61, and in
iris-gui dirs 5->6, if-addrs 0.13->0.15, toml 0.8->1 (matching the root).
Only 5 source lines had to move:

- cpal 0.18 (hal2): SampleRate is now a plain `type = u32` alias, all error
  types collapsed into cpal::Error, build_output_stream takes StreamConfig by
  value (it's Copy, so the f32-then-i16 fallback still passes it twice), and
  DeviceTrait::name() is gone in favour of the Display impl.
- socket2 0.6 (net): set_ttl -> set_ttl_v4, disambiguated from the IPv6 hop
  limit. The NAT ICMP socket is IPV4, so it's a straight substitution.
- png 0.18 (iris-gui): output_buffer_size() returns Option<usize>.
- rfd 0.16 dropped the async-std/tokio executor features; xdg-portal now
  pulls its own pollster.

Also declares windows-sys Win32_Foundation, which iris needed all along and
never asked for. thread_affinity's SetThreadAffinityMask/GetCurrentThread
name Foundation::HANDLE, but Win32_System_Threading doesn't imply that
feature — the Windows build only ever worked because rfd/socket2/
anstyle-wincon resolve to the same windows-sys and enable it themselves.
Feature unification is not a contract; drop any one of them and Windows
breaks in a way that reproduces nowhere else.

egui/eframe stay at 0.35 and the windowing stack they share (winit, glutin,
glutin-winit, glow, raw-window-handle) is untouched — winit especially, since
it's patched to third_party/winit-0.30.13 for the App Store private-API fix.
iris's own glow 0.13 is therefore still a second copy alongside eframe's 0.17;
png used to be split the same way and is now unified.

Verified: check clean across default, lightning+rex-jit+jit+chd+camera+pcap+
ultra64, r5k+r5ksc_triton+idle-pause, and iris-gui default/pcap/premiere/
appstore; 453+28 tests and 2 doctests pass; one fat-LTO release build of
iris-gui --features premiere,pcap links. The chd_disk tests genuinely create
and flatten compressed CHDs, so libchdman 0.289 is exercised, not just
compiled. dirs 5->6 was checked to leave config_dir()/data_dir() identical on
all three platforms, so gui.json doesn't move.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>