build: per-package CGU + dep dedup — workspace builds ~30% faster

Two complementary changes to reduce clean workspace build time from
~13min to ~8:43:

1. Per-package codegen-units overrides
   Default for all release builds: codegen-units = 16 (parallel LLVM).
   Numerical-sensitive crates (ml-* family, ndarray, nalgebra, cudarc,
   simba, etc.) override back to 1 to preserve bit-exact LLVM
   optimization decisions for the DQN regression suite.
   Non-numerical plumbing (arrow, sqlx, tokio, parquet, ...) compiles
   in parallel via 16 CGUs, no numerical impact.

2. Dependency deduplication
   - axum 0.7 → 0.8 (workspace + services/api): dedupes vs tonic 0.14's
     transitive axum 0.8. Eliminates a full duplicate compile of axum
     and axum-core.
   - statrs 0.17 → 0.18: dedupes nalgebra 0.32 vs 0.33. Also closes a
     numerical concern (two nalgebra versions linked simultaneously).
   - governor 0.6 → 0.10 (services/api + crates/data): dedupes dashmap
     5 vs 6. dashmap is heavy; eliminating one full compile is a real
     win.
   - hashbrown 0.14 → 0.16 (workspace): partial dedupe (dashmap 6.1
     still pulls 0.14 transitively).
   - Workspace Cargo.toml documents residual unfixable duplicates with
     reasons (base64, chacha20, phf, darling, itertools, getrandom,
     hashbrown, syn, thiserror — all blocked by third-party crates we
     can't bump without breakage).

Verified: cargo check --workspace passes.  Numerical crates remain
at codegen-units = 1 — DQN bit-exact reproducibility preserved.

services/api/Cargo.toml

@@ -16,7 +16,6 @@ path = "src/main.rs"
 tokio = { workspace = true, features = ["sync", "time"] }
 anyhow.workspace = true
 tracing.workspace = true
-tracing-subscriber.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 once_cell.workspace = true
@@ -24,40 +23,31 @@ clap.workspace = true
 
 # gRPC and networking (Tonic 0.14)
 tonic = { workspace = true, features = ["transport", "server", "tls-ring", "tls-webpki-roots"] }
+# Used by generated proto code: tonic_prost::ProstCodec
 tonic-prost.workspace = true
 tonic-reflection.workspace = true
 tonic-health.workspace = true
+# Used by generated proto code: ::prost::Message derive
 prost.workspace = true
 tower = { workspace = true, features = ["util"] }
-tower-layer.workspace = true
-tower-service.workspace = true
-hyper.workspace = true
-http-body.workspace = true
 http-body-util.workspace = true
-hyper-util.workspace = true
-bytes.workspace = true
 
 # Async streams and futures
-tokio-stream.workspace = true
 async-stream.workspace = true
 futures.workspace = true
-async-trait.workspace = true
 
 # Performance monitoring
-hdrhistogram.workspace = true
 prometheus = { workspace = true, features = ["process"] }
 
 # Cryptography and security
 sha2.workspace = true
 x509-parser = { version = "0.16", features = ["verify"] }
-reqwest = { version = "0.12", features = ["rustls-tls"], default-features = false }
+reqwest = { version = "0.12", features = ["rustls-tls", "json"], default-features = false }
 base64.workspace = true
 jsonwebtoken.workspace = true
 chrono.workspace = true
 ocsp = "0.4"
 lru = "0.12"
-hex = "0.4"
-const-oid = "0.9"
 
 # MFA/TOTP dependencies (optional, enabled by default via "mfa" feature)
 totp-rs = { version = "5.6", optional = true }
@@ -68,18 +58,14 @@ hmac = { version = "0.12", optional = true }
 sha1 = "0.10"
 urlencoding = { version = "2.1", optional = true }
 secrecy = { version = "0.8", features = ["serde"] }
-zeroize.workspace = true
 
 thiserror.workspace = true
 uuid.workspace = true
 sqlx = { workspace = true, features = ["postgres", "chrono", "uuid", "json", "macros"] }
 
-num-traits.workspace = true
-rust_decimal.workspace = true
 rand.workspace = true
 
 # Internal workspace crates
-trading_engine.workspace = true
 common = { workspace = true, features = ["database"] }
 config = { workspace = true, features = ["postgres"] }
 
@@ -90,9 +76,9 @@ redis = { workspace = true, features = ["tokio-comp", "connection-manager"] }
 kube = { version = "3.0", features = ["client", "runtime", "derive"] }
 k8s-openapi = { version = "0.27", features = ["latest"] }
 
-# Rate limiting
-governor = "0.6"
-dashmap = "6.0"
+# Rate limiting (governor 0.10 dedupes dashmap to v6)
+governor = "0.10"
+dashmap = { workspace = true }
 
 # HTTP and networking
 http = "1.1"
@@ -106,8 +92,8 @@ regex = "1.11"
 # TLS crypto provider for kube-rs in-cluster client
 rustls = { version = "0.23", default-features = false, features = ["ring"] }
 
-# HTTP server for Prometheus metrics endpoint
-axum = "0.7"
+# HTTP server for Prometheus metrics endpoint (workspace pinned to 0.8 to dedupe with tonic)
+axum.workspace = true
 
 # gRPC-Web support for browser access
 tonic-web = "0.13"