chore(rustd): the workspace claimed a licence the project does not ship under

`[workspace.package]` has said `Apache-2.0` since the first commit of the Rust
port. The repository's own `LICENSE` is MIT, and so is `cli/package.json` —
which made this workspace the only part of the product claiming a different
one. Nothing enforces agreement between them, so it would have kept saying it.

Names an author alongside it, inherited by every member rather than repeated
in eight manifests.

The dependency declarations here are inert until the code that imports them
lands in the next commit; they are manifest facts and belong with the manifest:

- `tokio`'s `sync` feature, for the `Semaphore` the admission ceiling is built
  from. Three existing call sites (`hub.rs`, `jwks/cache.rs`) already use
  `tokio::sync` and were relying on redis and sqlx to turn the feature on for
  them — unification is not a contract, so it is stated.
- `hyper` and `hyper-util`, taken directly rather than through `axum::serve`,
  which exposes no way to bound a connection's header buffer.