chore: replace yanked aes/crypto-bigint deps and bump russh to 0.62 (#284)

## Summary

`aes 0.9.0` and `crypto-bigint 0.7.3` were yanked from crates.io. Both are transitive dependencies pulled in through `russh` (the pure-Rust SSH client used by `view --ssh`). This PR moves off the yanked versions and brings the rest of the dependency graph current.

## Changes

- `cargo update` across the whole lockfile, which replaces the yanked crates with `aes 0.9.1` and `crypto-bigint 0.7.5` (both the latest published, non-yanked releases) and applies all other in-range updates.
- Bump the manifest constraint `russh 0.61 -> 0.62` (resolves to `0.62.2`, the latest). Its only breaking change is on the server-side `Handler::channel_open_*` signatures, which our client-side `client::Handler` impl does not implement, so no source changes were needed.
- Bump `tower-http 0.6 -> 0.7`. Its only breaking change (`GrpcCode`/`GrpcFailureClass` becoming `#[non_exhaustive]`) does not touch the `CorsLayer`/`TraceLayer` usage in `src/api/server.rs`.

As a side effect, `russh 0.62` pulls several crypto crates from prerelease to stable: `ecdsa 0.17.0`, `elliptic-curve 0.14.1`, `primeorder 0.14.0`, `ssh-cipher 0.3.0`, `ssh-encoding 0.3.0`.

## Notes

- The remaining prerelease crypto crates (`ed25519-dalek`, `curve25519-dalek`, `p256/p384/p521`, `ssh-key`) are pinned to those RC ranges by `russh 0.62` itself upstream and cannot be advanced without patching `russh`. All were verified as not yanked.
- `tower-http 0.6.11` still appears once in the tree via `reqwest 0.13`; our direct dependency is `0.7.0`.
- No Rust source changes: only `Cargo.toml` (2 lines) and `Cargo.lock`.

## Testing

- `cargo build --release --all-features` passes.
- `cargo clippy --release --all-features --all-targets` passes with no warnings.
- `cargo fmt --check` clean.
- `cargo test --release --all-features` passes.