chore(deps): batch-apply all open dependabot bumps (2026-07-23)

Applies all 22 open dependabot PRs in one pass (CI on those PRs never
ran — Actions minutes exhausted). Verified locally via the ci-check
mirror: builds (all tag variants), vet, golangci-lint, sqlc/protocol
verify, vitest 3304/3304, npm audit clean, cargo check.

Server (Go): wazero 1.12.0, x/mod 0.38.0, chi 5.3.1, otel 1.44.0,
otel/trace 1.44.0, otel prometheus exporter 0.66.0, modernc sqlite
1.54.0, livekit/protocol 1.50.2, koanf/v2 2.3.5, x/sync 0.22.0.
Also x/text 0.39.0 (fixes GO-2026-5970, flagged by govulncheck).
livekit/protocol requires Go 1.26 → go.mod, CI pins, and docs bumped.

Client (npm, lockfile-only): playwright/test 1.61.1, oxlint 1.75.0,
eslint 9.39.5, knip 6.29.0, plugin-http 2.5.9, plugin-fs 2.5.1,
plugin-opener 2.5.4, tauri-apps/api 2.11.1 + npm audit fix
(brace-expansion, fast-uri transitive highs).

Client (cargo, lockfile-only): futures-util 0.3.33, env_logger
0.11.11, serde 1.0.229, tauri-typegen 0.5.2.

Closes #1204 #1205 #1206 #1207 #1209 #1210 #1211 #1212 #1213 #1214
Closes #1215 #1216 #1219 #1220 #1221 #1222 #1223 #1225 #1226 #1227 #1228 #1224

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/architecture/server.md

@@ -2,7 +2,7 @@
 
 **Verified against:** commit `ddc49f0`, 2026-07-19
 
-Single Go binary (`github.com/owncord/server`, Go 1.25). Pure-Go SQLite
+Single Go binary (`github.com/owncord/server`, Go 1.26). Pure-Go SQLite
 (`modernc.org/sqlite`, no CGO), chi router, `nhooyr.io/websocket`, LiveKit for
 voice, Wazero for plugins (build-tag gated), optional OpenTelemetry
 (`-tags otel`). Roughly 29k LOC of production code and 46k LOC of tests.

docs/contributing.md

@@ -12,7 +12,7 @@ How to set up the development environment and contribute to OwnCord.
 | Linux x64 | ✅ | ✅ |
 | Linux ARM64 | ✅ | ✅ (CI only) |
 
-- **Go 1.25+** (server)
+- **Go 1.26+** (server)
 - **Node.js 20+** (client)
 - **Rust / Cargo** (Tauri client — not needed for server-only work)
 - **Docker + Compose v2** (optional — alternative to building the server locally)

docs/deployment.md

@@ -5,7 +5,7 @@ Production deployment guide for OwnCord server on Windows and Linux.
 ## Prerequisites
 
 - **Windows 10+** (x64) or **Linux** (x64)
-- **Go 1.25+** (only if building from source)
+- **Go 1.26+** (only if building from source)
 - **LiveKit Server** binary (only if enabling voice/video) -- see [LiveKit Setup](livekit-setup.md)
 - Required port: `8443` (OwnCord HTTPS/WebSocket)
 - Additional ports for voice/video: `7880/TCP`, `7881/TCP`, `50000-60000/UDP`

docs/quick-start.md

@@ -19,7 +19,7 @@ Get OwnCord running with the fewest possible steps.
 
 ## Prerequisites
 
-- Go 1.25+ (only if building server from source)
+- Go 1.26+ (only if building server from source)
 - Node.js 20+ and Rust (only if building client from source)
 - Docker + Compose v2 (Docker path only)
 - LiveKit (optional, required for voice/video)