fix(deps): bump lettre to 0.11.22 to clear RUSTSEC-2026-0141

The previous pin (`lettre = "0.11.19"` resolved as `0.11.21`) is flagged
by `cargo-audit` for RUSTSEC-2026-0141: an inverted boolean disabled TLS
hostname verification on the `boring-tls` backend in `0.10.1..0.11.21`.

OpenHuman builds `lettre` with `default-features = false, features =
["builder", "smtp-transport", "rustls-tls"]`, so the `boring-tls`
backend is never active and this is not exploitable at runtime — but
the weekly code-review report (#2084) and `cargo-audit` keep flagging
the pin until the resolved version moves past the patched cutoff.

`0.11.22` is the fixed release. The patch is API-compatible; `0.11.20`
raised MSRV to 1.85 but OpenHuman targets Rust 1.93 per
`rust-toolchain.toml`. The two consumer sites
(`src/openhuman/audio_toolkit/ops.rs` and
`src/openhuman/channels/providers/email_channel.rs`) only touch
`Message`, `SmtpTransport`, `Transport`, `Credentials`, and message-
builder types, none of which changed.

- `Cargo.toml`: `0.11.19` -> `0.11.22`
- `Cargo.lock`: `lettre` `0.11.21` -> `0.11.22`
- `app/src-tauri/Cargo.lock`: `lettre` `0.11.21` -> `0.11.22`

Verified locally:
- `cargo check --manifest-path Cargo.toml` clean (pre-existing
  warnings only)
- `cargo test --lib email_channel` 50/50 pass
- `cargo test --lib audio_toolkit` 10/10 pass
- `cargo fmt --check` clean
- `cargo clippy --lib --no-deps` no new warnings

Closes #2274

Cargo.lock

@@ -3669,9 +3669,9 @@ checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
 
 [[package]]
 name = "lettre"
-version = "0.11.21"
+version = "0.11.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dabda5859ee7c06b995b9d1165aa52c39110e079ef609db97178d86aeb051fa7"
+checksum = "0da65617f6cb926332d039cb578aad56178da86e128db6a1b09f4c94fa5b3349"
 dependencies = [
  "base64 0.22.1",
  "email-encoding",

Cargo.toml

@@ -114,7 +114,7 @@ webpki-roots = "1.0.6"
 sysinfo = { version = "0.33", default-features = false, features = ["system"] }
 clap = { version = "4.5", features = ["derive"] }
 clap_complete = "4.5"
-lettre = { version = "0.11.19", default-features = false, features = ["builder", "smtp-transport", "rustls-tls"] }
+lettre = { version = "0.11.22", default-features = false, features = ["builder", "smtp-transport", "rustls-tls"] }
 mail-parser = "0.11.2"
 async-imap = { version = "0.11", features = ["runtime-tokio"], default-features = false }
 axum = { version = "0.8", default-features = false, features = ["http1", "json", "tokio", "query", "ws", "macros"] }

app/src-tauri/Cargo.lock

@@ -3943,9 +3943,9 @@ checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
 
 [[package]]
 name = "lettre"
-version = "0.11.21"
+version = "0.11.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dabda5859ee7c06b995b9d1165aa52c39110e079ef609db97178d86aeb051fa7"
+checksum = "0da65617f6cb926332d039cb578aad56178da86e128db6a1b09f4c94fa5b3349"
 dependencies = [
  "base64 0.22.1",
  "email-encoding",