chore(deps): bump jsonwebtoken from 9.3.1 to 10.3.0 in the cargo group across 1 directory

.agents/documents/application/blueprint-audit.md

@@ -165,7 +165,7 @@
 | ADRs for major choices | ADR-001 `axum` over `actix-web` (benchmark + Tower alignment), ADR-002 `sqlx` primary + `sea-orm` shim, ADR-003 single `tokio` runtime, ADR-004 workspace crates per domain, ADR-005 `AppState: Arc` over facades, ADR-006 `vector` feature-flag — all `Accepted` with alternatives + consequences | PASS |
 | Dependency DAG realizability | Workspace DAG acyclic per `architecture.md` §3 proof sketch; M0 root → M6 feature-flagged leaf ensures no reverse edge; `xtask check-cycles` gate in `roadmap.md` §5 | PASS |
 | Estimates vs capacity | `prd.md` §7 + `roadmap.md` §6 + `sprints/allocation-audit.md` §5: 26–36 dev-weeks → 13–18 wks @2 devs, +20% contingency (30–40% M6); 7 sprints sized to estimates; no sprint overloaded | PASS |
-| Contracts realizable in Rust | `tdd.md` §3 trait signatures use stable Rust 1.80+ (`Arc`, `OnceLock`, `async_trait`, `serde`, `jsonwebtoken`, `pgvector`); no `unsafe`, no `any`, no `static mut`; proc-macros via `syn`/`quote` | PASS |
+| Contracts realizable in Rust | `tdd.md` §3 trait signatures use stable Rust 1.88+ (`Arc`, `OnceLock`, `async_trait`, `serde`, `jsonwebtoken`, `pgvector`); no `unsafe`, no `any`, no `static mut`; proc-macros via `syn`/`quote` | PASS |
 | Risk register | 9 risks with L×I, top-5 with mitigations in `prd.md` §7 + `validation.md` §4.2; mitigations (feature-flag per provider, `OnceLock` queue registry, `has_extension("vector")` guard) are in `fsd.md`/`tdd.md` | PASS |
 | M6 scope risk (Very High, 13 FRs) | `roadmap.md` §4 + `sprints/manifest.md` §2 flag M6 as largest sprint; mitigation is per-provider feature flags + incremental adapter landing without blocking Storage/JSON:API/Broadcast core | PASS (observation, not gap) |
 | Capacity/SLA realism | `capacity.md` derived SLOs (p50 <2s boot, p95 <50ms HTTP, etc.) with measurement harness (`criterion`/`oha`), degradation modes, scaling guidance — not speculative | PASS |

.agents/documents/design/architecture.md

@@ -15,7 +15,7 @@
 | G-03 | Hardened security defaults (Laravel 13 #11/#12) | Security | JSON session serialization default; `serializable_classes` allow-list; `Sec-Fetch-Site` CSRF; `-cache-` hyphenated prefixes |
 | G-04 | AI/vector-native from day one (Laravel 13 #6, #1–#2) | Differentiator | `pgvector` feature-flagged but present in M2; `rustasea-ai` is `optional` but its trait is designed upfront |
 
-**Hard constraints (C-01–C-05 from PRD §5):** Rust 1.80+ stable, edition 2021, `tokio` everywhere; no `static mut` facades (`Arc<AppState>` via `axum::extract::State`); no `any`/`Box<dyn Any>` for domain payloads; `rustfmt`+`clippy -D warnings` on all `make:*` output; each crate `cargo check`-clean standalone.
+**Hard constraints (C-01–C-05 from PRD §5):** Rust 1.88+ stable, edition 2021, `tokio` everywhere; no `static mut` facades (`Arc<AppState>` via `axum::extract::State`); no `any`/`Box<dyn Any>` for domain payloads; `rustfmt`+`clippy -D warnings` on all `make:*` output; each crate `cargo check`-clean standalone.
 
 ---
 

.agents/documents/design/decisions/ADR-003-tokio-stack.md

@@ -5,6 +5,7 @@
 > **Deciders:** Tech Lead, Platform  
 > **Milestone:** M0 (Foundation; spans all milestones)  
 > **Related:** FR-004 · FS-M0-04 · BR-08/C-01 · NFR-Per-01/NFR-Rel-01
+> **MSRV superseded:** ADR-0001 raises the workspace MSRV 1.80 → 1.88 (`jsonwebtoken` 10, edition 2024). The `tokio` single-runtime decision below is unchanged.
 
 ## Context
 

.agents/documents/design/design-system.md

@@ -14,7 +14,7 @@
 | **Brand name** | RustaSea |
 | **Primary concept** | Laravel ergonomics × Rust safety — the DX *is* the brand |
 | **Style direction** | Minimal, convention-over-configuration, zero-cost ergonomics — same values as the brief. Scaffold must feel "Laravel `artisan make:*`" to an ex-Laravel developer, and feel "idiomatic Rust" to a Rustacean on first `cargo run`. |
-| **Target framework** | Rust workspace (edition 2021, MSRV 1.80+) — `tokio` + `axum` + `sqlx` via `cargo xtask` + `clap` (derive) |
+| **Target framework** | Rust workspace (edition 2021, MSRV 1.88+) — `tokio` + `axum` + `sqlx` via `cargo xtask` + `clap` (derive) |
 | **Dark mode** | Not applicable (no browser UI). CLI respects `NO_COLOR` (https://no-color.org) and `FORCE_COLOR` for terminal theming — see §4. |
 
 ---

.agents/documents/requirements/brd.md

@@ -16,7 +16,7 @@ RustaSea is a Rust framework that delivers Laravel-grade developer ergonomics 
 
 **Business problem:** Teams that outgrow PHP/Ruby/Node on throughput, correctness, or concurrency face a productivity cliff when moving to Rust or Go: idiomatic Rust frameworks (axum, actix) are minimal and unopinionated; Go ports (Goravel) still leak `any`/`interface{}` and global facades. No Rust framework offers Laravel parity — routing ergonomics, typed Eloquent, Artisan CLI, queue/schedule/event orchestration, and AI-native primitives — behind a single `rustasea` umbrella crate.
 
-**Why now:** Laravel 13 (2026-03-17) shipped AI SDK + vector search + expanded attributes + queue routing — the innovation frontier is now AI-native + vector + declarative DX. Rust (1.80+, edition 2021) + `tokio` + `axum` + `sqlx`/`pgvector` have stabilized enough to port these idioms natively. Goravel v1.18 proves the Laravel→compiled-language thesis commercially.
+**Why now:** Laravel 13 (2026-03-17) shipped AI SDK + vector search + expanded attributes + queue routing — the innovation frontier is now AI-native + vector + declarative DX. Rust (1.88+, edition 2021) + `tokio` + `axum` + `sqlx`/`pgvector` have stabilized enough to port these idioms natively. Goravel v1.18 proves the Laravel→compiled-language thesis commercially.
 
 ---
 
@@ -93,7 +93,7 @@ RustaSea is a Rust framework that delivers Laravel-grade developer ergonomics 
 
 ### Constraints
 
-- **C-01** Rust 1.80+ stable, edition 2021, `tokio` async throughout — no sync facade.
+- **C-01** Rust 1.88+ stable, edition 2021, `tokio` async throughout — no sync facade.
 - **C-02** Workspace per-crate feature gating — incremental adoption must stay `cargo check`-clean with a single crate.
 - **C-03** No global `static mut` facades — `AppState` via `axum::extract::State` (`OnceLock`/`Arc`), unlike Goravel `facades.*`.
 - **C-04** Generated code via `make:*` must be `rustfmt`-clean and `clippy -- -D warnings` clean.

.agents/documents/requirements/prd.md

@@ -193,7 +193,7 @@ This PRD translates the BRD's business requirements into **numbered, testable fu
 | NFR-Usa-03 | Generated code quality | Usability | Must | `rustfmt` + `clippy -- -D warnings` clean on all `make:*` output | C-04 |
 | NFR-Sca-01 | Connection pooling | Scalability | Must | `deadpool` pools sized via config; handles 100 concurrent queue workers + 1k HTTP concurrency in bench | BR-05 |
 | NFR-Sca-02 | Workspace modularity | Scalability | Must | Single-crate check (`rustasea-router` only) passes; dep tree does not pull ORM/queue/AI | BR-08 |
-| NFR-Com-01 | MSRV | Compatibility | Must | Rust 1.80+, edition 2021; `tokio` 1.x | C-01 |
+| NFR-Com-01 | MSRV | Compatibility | Must | Rust 1.88+, edition 2021; `tokio` 1.x | C-01 |
 | NFR-Com-02 | Supported DBs | Compatibility | Must | Postgres (primary), MySQL, SQLite; vectors only on Postgres/MariaDB (feature-flagged) | BR-03 |
 | NFR-Mai-01 | Observability parity | Maintainability | Should | `route:list` binding fields + `show:model` + queue metrics (#8) all via typed traits, not ad-hoc logging | #20 · #8 |
 
@@ -203,7 +203,7 @@ This PRD translates the BRD's business requirements into **numbered, testable fu
 
 | # | Constraint | Applies To |
 |---|------------|------------|
-| C-01 | Rust 1.80+ stable, `tokio` everywhere | All |
+| C-01 | Rust 1.88+ stable, `tokio` everywhere | All |
 | C-02 | No global `static mut` facades — `AppState` via `axum::extract::State` | All |
 | C-03 | No `any`/`interface{}` for domain payloads (`Job<T>`, `Event<T>`) | M4, M6 |
 | C-04 | `rustfmt` + `clippy -D warnings` clean on all generated code | M5, M6 |

.agents/documents/tasks/sprints/manifest.md

@@ -28,7 +28,7 @@
 
 ## 3. Capacity Assumptions (per roadmap §6)
 
-- Team: **2 developers**, Rust 1.80+ stable, edition 2021, `tokio` everywhere.
+- Team: **2 developers**, Rust 1.88+ stable, edition 2021, `tokio` everywhere.
 - Wall-clock: **~13–18 weeks** at 2 devs (26–36 dev-weeks) +20% contingency (30–40% on M6).
 - Sprint velocity is calibrated after Sprint 01; `NFR-Per-04` (`cargo check` after `make:*` <10s incremental) and `NFR-Per-01` (cold boot <2s) are CI gates each sprint.
 

.agents/documents/testing/test-plan.md

@@ -2,7 +2,7 @@
 
 > **Owner:** vheins/rustasea | **Phase:** Implementation P5 | **Task:** TASK-010 | **Date:** 2026-09-07
 > **Parents:** `brd.md` (BR-01..09) · `prd.md` (FR-000..612, NFR-*) · `fsd.md` (FS-M0-01..M6-07) · `bdd-scenarios.md` (33 features)
-> **Stack:** Rust 1.80+, edition 2021, `tokio`, `axum`+`tower`, `sqlx`/`sea-orm`, `deadpool`, `validator`, `jsonwebtoken`+`argon2`, `serde`, `config`+`dotenvy`, `clap`+`xtask`, `syn`/`quote`, `moka`+`deadpool-redis`, `askama`, `reqwest`, `object_store`, `pgvector`+`async-openai`, `testcontainers`, `cargo test`
+> **Stack:** Rust 1.88+, edition 2021, `tokio`, `axum`+`tower`, `sqlx`/`sea-orm`, `deadpool`, `validator`, `jsonwebtoken`+`argon2`, `serde`, `config`+`dotenvy`, `clap`+`xtask`, `syn`/`quote`, `moka`+`deadpool-redis`, `askama`, `reqwest`, `object_store`, `pgvector`+`async-openai`, `testcontainers`, `cargo test`
 > **Reference:** `docs/laravel-13-research.md` (20 Laravel 13 features) · `README.md` §Milestones · `test-architecture.md` (4-concern rule)
 
 ---